Posts by 404Gh0st
BITSCTF 2026
Writeup for BITSCTF 2026
404Gh0st24 min read
HTB: Fluffy
Fluffy is an easy Windows machine that demonstrates CVE-2025-24071, Shadow Credentials technique, and ESC16 vulnerability on ADCS.
HTB: Nocturnal
Nocturnal is an easy Linux machine that demonstrates command injection bypass and privilege escalation using CVE-2023-46818.
HTB: Planning
Planning is an easy Linux machine that demonstrates CVE-2024-9264 to get initial access and using crontab-ui to escalate privilege.
HTB: Puppy
Puppy is a medium Windows machine. This is a grey box machine with a supplied credential. With the credential, we can take advantage of GenericWrite to get access to specific shares. Then, we found a KeePass database file that contains a valid credential for another user account. This user account has GenericAll to another user account that belongs to the Remote Management Users group. There will be a backup file that contains another credential inside the machine. Using the credential, we found a saved credential in the DPAPI that contains a credential for administrative user account.
HTB: Environment
Environment is a Linux machine. The box involves exploiting a Laravel web application vulnerability (CVE-2024-52301) to bypass authentication and upload a shell. It involves finding and decrypting a GPG backup file to obtain credentials, and finally escalating privileges to root by abusing sudo permissions and the BASH_ENV variable.
HTB: Haze
Haze is a challenging Active Directory machine characterized by a vulnerable Splunk installation and security configurations. The machine involves CVE-2024-36991, decrypting the Splunk secret, exploiting multiple ACL/ACE vulnerabilities, and abusing SeImpersonatePrivilege.
HTB: Code
Code is an easy Linux machine that demonstrates a Python Jail / Sandbox escape and privilege escalation from backy program.
HTB: TheFrizz
TheFrizz is a medium Windows machine. The box involves attacking a domain controller using Kerberos authentication, abusing Group Policy Objects (GPO), and leveraging the Recycle Bin. The attack path includes exploiting CVE-2023-45878 on Gibbon LMS, obtaining credentials, manipulating GPO settings, and finally achieving system access.
HTB: Dog
Dog is an easy Linux machine that demonstrates exposed Git repository, vulnerable Backdrop CMS installation, and privilege escalation through Backdrop CMS bee utility program.
HTB: Cypher
Cypher is a medium-difficulty box that demonstrates Cypher injection, JAR file reversing, and privilege escalation through bbot.
HTB: Checker
Checker is a challenging machine that demonstrates CVE-2023-1545 on Teampass, CVE-2023-6199 on BookStack, the use of Google Authenticator as SSH TOTP, and a race condition on shared memory for privilege escalation.
HTB: Titanic
Titanic is an easy Linux machine that demonstrates a basic Arbitrary File Read vulnerability, Gitea hash cracking, and exploitation of a vulnerable version of ImageMagick.
HTB: DarkCorp
Coming Soon
HTB: Vintage
Vintage is a challenging Active Directory machine characterized by disabled NTLM authentication, enabled antivirus protection, and complex security configurations. The machine involves exploiting a Pre-2000 computer account, leveraging multiple ACL/ACE vulnerabilities, decrypting Data Protection API (DPAPI) secrets, and manipulating Resource-Based Constrained Delegation.