404Gh0st (Author) | 404Gh0st Blog

404Gh0st

he/him

Pwner wannabe

Posts by 404Gh0st

BITSCTF 2026
Writeup for BITSCTF 2026
4404Gh0st
February 22, 2026
24 min read
PwnKernelStackHeap
HTB: Fluffy
Fluffy is an easy Windows machine that demonstrates CVE-2025-24071, Shadow Credentials technique, and ESC16 vulnerability on ADCS.
4404Gh0st
May 31, 2025
9 min read
WindowsEasyCVE-2025-24071GenericAllGenericWriteShadow CredentialsADCSESC16
HTB: Nocturnal
Nocturnal is an easy Linux machine that demonstrates command injection bypass and privilege escalation using CVE-2023-46818.
4404Gh0st
May 31, 2025
6 min read
LinuxEasyCommand InjectionISPConfigCVE-2023-46818
HTB: Planning
Planning is an easy Linux machine that demonstrates CVE-2024-9264 to get initial access and using crontab-ui to escalate privilege.
4404Gh0st
May 31, 2025
4 min read
LinuxEasyCVE-2024-9264GrafanaCrontab UI
HTB: Puppy
Puppy is a medium Windows machine. This is a grey box machine with a supplied credential. With the credential, we can take advantage of GenericWrite to get access to specific shares. Then, we found a KeePass database file that contains a valid credential for another user account. This user account has GenericAll to another user account that belongs to the Remote Management Users group. There will be a backup file that contains another credential inside the machine. Using the credential, we found a saved credential in the DPAPI that contains a credential for administrative user account.
4404Gh0st
May 30, 2025
8 min read
WindowsMediumGenericWriteGenericAllDPAPI
HTB: Environment
Environment is a Linux machine. The box involves exploiting a Laravel web application vulnerability (CVE-2024-52301) to bypass authentication and upload a shell. It involves finding and decrypting a GPG backup file to obtain credentials, and finally escalating privileges to root by abusing sudo permissions and the BASH_ENV variable.
4404Gh0st
May 4, 2025
5 min read
LinuxMediumCVE-2024-52301LaravelFile UploadGPGBASH_ENV
HTB: Haze
Haze is a challenging Active Directory machine characterized by a vulnerable Splunk installation and security configurations. The machine involves CVE-2024-36991, decrypting the Splunk secret, exploiting multiple ACL/ACE vulnerabilities, and abusing SeImpersonatePrivilege.
4404Gh0st
March 31, 2025
13 min read
WindowsHardActive DirectorySplunkCVE-2024-36991Password SprayingWriteOwnerShadow CredentialsSeImpersonatePrivilegeGodPotato
HTB: Code
Code is an easy Linux machine that demonstrates a Python Jail / Sandbox escape and privilege escalation from backy program.
4404Gh0st
March 23, 2025
4 min read
LinuxEasyPyjail
HTB: TheFrizz
TheFrizz is a medium Windows machine. The box involves attacking a domain controller using Kerberos authentication, abusing Group Policy Objects (GPO), and leveraging the Recycle Bin. The attack path includes exploiting CVE-2023-45878 on Gibbon LMS, obtaining credentials, manipulating GPO settings, and finally achieving system access.
4404Gh0st
March 17, 2025
9 min read
WindowsMediumActive DirectoryKerberosGibbon LMSRecycle BinGPO
HTB: Dog
Dog is an easy Linux machine that demonstrates exposed Git repository, vulnerable Backdrop CMS installation, and privilege escalation through Backdrop CMS bee utility program.
4404Gh0st
March 10, 2025
3 min read
LinuxEasyBackdropCMS
HTB: Cypher
Cypher is a medium-difficulty box that demonstrates Cypher injection, JAR file reversing, and privilege escalation through bbot.
4404Gh0st
March 2, 2025
5 min read
LinuxMediumCypher InjectionNeo4jbbot
HTB: Checker
Checker is a challenging machine that demonstrates CVE-2023-1545 on Teampass, CVE-2023-6199 on BookStack, the use of Google Authenticator as SSH TOTP, and a race condition on shared memory for privilege escalation.
4404Gh0st
February 28, 2025
14 min read
LinuxHardTOTPBookstackTeampassRace Condition
HTB: Titanic
Titanic is an easy Linux machine that demonstrates a basic Arbitrary File Read vulnerability, Gitea hash cracking, and exploitation of a vulnerable version of ImageMagick.
4404Gh0st
February 22, 2025
5 min read
LinuxEasyArbitrary File ReadGiteaImageMagick
HTB: DarkCorp
Coming Soon
4404Gh0st
February 15, 2025
1 min read
WindowsInsane
HTB: Vintage
Vintage is a challenging Active Directory machine characterized by disabled NTLM authentication, enabled antivirus protection, and complex security configurations. The machine involves exploiting a Pre-2000 computer account, leveraging multiple ACL/ACE vulnerabilities, decrypting Data Protection API (DPAPI) secrets, and manipulating Resource-Based Constrained Delegation.
4404Gh0st
January 15, 2025
12 min read
WindowsHardActive DirectoryPre2KKerberosDPAPIGenericWriteGenericAllTargeted ASREProastingRBCD