Hack The Box and OWASP Juice Shop writeups.https://writeups.amvatlabs.com/https://writeups.amvatlabs.com/htb/markup/https://writeups.amvatlabs.com/htb/markup/A MegaShopping web app accepts weak default credentials and parses user-supplied XML without protection, so an XXE payload reads arbitrary files from the host — including Daniel's SSH private key, which gives a foothold over SSH. A scheduled batch script, job.bat, is world-writable, so overwriting it with a netcat reverse-shell command and waiting for the task to fire returns a shell as Administrator.Wed, 11 Nov 2026 00:00:00 GMTxxexml-external-entityfile-disclosuressh-keyinsecure-permissionsscheduled-taskwritable-scriptnetcat-reverse-shellprivilege-escalationwindowshttps://writeups.amvatlabs.com/htb/magic/https://writeups.amvatlabs.com/htb/magic/A portfolio site's login form is bypassed with a SQL injection, exposing an image upload page. Weak content validation is defeated by prepending PNG magic bytes to a PHP webshell, giving code execution as www-data and a reverse shell. A database config file leaks MySQL credentials; mysqldump recovers a plaintext password that is reused to become theseus. A custom SUID binary, /bin/sysinfo, calls helper tools by relative name, so PATH hijacking a malicious lshw yields a shell as root.Tue, 10 Nov 2026 00:00:00 GMTsql-injectionauth-bypassfile-uploadmagic-bytesphp-webshellreverse-shellmysqlmysqldumpplaintext-credentialspassword-reusesuidpath-hijackingprivilege-escalationhttps://writeups.amvatlabs.com/htb/cozyhosting/https://writeups.amvatlabs.com/htb/cozyhosting/A Spring Boot app leaks an admin session cookie through an exposed Actuator endpoint, giving access to a dashboard whose SSH feature is vulnerable to command injection. A reverse shell leads to the application JAR, which holds hardcoded PostgreSQL credentials; the database yields a bcrypt hash that cracks to the password for the user josh. josh may run ssh as root via sudo, and the LocalCommand directive is abused to execute a shell as root.Mon, 09 Nov 2026 00:00:00 GMTspring-bootactuatorsession-hijackingcommand-injectionreverse-shelljar-analysishardcoded-credentialspostgresqlbcrypthashcatsudosshgtfobinshttps://writeups.amvatlabs.com/htb/titanic/https://writeups.amvatlabs.com/htb/titanic/A ticket-booking site leaks files through an unauthenticated arbitrary file read on its /download endpoint. A second vHost running Gitea reveals a docker-compose bind mount, which we use to read the Gitea config and pull its SQLite database off disk. Cracking the developer PBKDF2 hash gives SSH access, and a root cron running a vulnerable ImageMagick (CVE-2024-41817) with an empty LD_LIBRARY_PATH is abused with a malicious shared library for root.Sun, 08 Nov 2026 00:00:00 GMTapachevhost-fuzzinggiteaarbitrary-file-readpath-traversalsqlitehashcatimagemagickcve-2024-41817ld-library-pathcronsshhttps://writeups.amvatlabs.com/htb/editorial/https://writeups.amvatlabs.com/htb/editorial/A publishing web app lets us preview a book cover from a URL, giving a blind SSRF that we use to port-scan localhost and reach an internal API on port 5000. One of its endpoints leaks dev credentials for SSH. In dev's home a Git repo's history exposes a second set of credentials for the prod user. prod may run a GitPython clone script as root; GitPython 3.1.29 is vulnerable to CVE-2022-24439, an ext:: URL RCE, used to run a reverse shell as root.Fri, 06 Nov 2026 00:00:00 GMTssrfinternal-apiport-scanninginformation-disclosurecredentialssshgitgit-logpassword-reusegitpythoncve-2022-24439sudohttps://writeups.amvatlabs.com/htb/editor/https://writeups.amvatlabs.com/htb/editor/An XWiki instance on a hidden vhost is vulnerable to CVE-2025-24893, an unauthenticated Groovy injection in the SolrSearch endpoint, which is used to stage and run a reverse shell as the xwiki user. XWiki's hibernate.cfg.xml leaks a database password reused for SSH as oliver. oliver belongs to the netdata group, and the SUID ndsudo helper (CVE-2024-32019) resolves its target binaries through the untrusted PATH, so a PATH hijack runs an attacker-controlled binary as root.Thu, 05 Nov 2026 00:00:00 GMTxwikicve-2025-24893groovy-injectionrceinformation-disclosurepassword-reusesshnetdatacve-2024-32019path-hijackingsuidhttps://writeups.amvatlabs.com/htb/linkvortex/https://writeups.amvatlabs.com/htb/linkvortex/An exposed .git directory on a dev vhost is dumped to recover a Ghost CMS admin password from a committed change. Ghost 5.58.0 is vulnerable to CVE-2023-40028, an authenticated symlink arbitrary file read, used to read the Ghost config and recover bob's SSH password. bob may run a symlink-cleaning script as root that reads a file after a vulnerable check; a TOCTOU race swaps the symlink target to root's SSH key, leaking it for a root login.Thu, 05 Nov 2026 00:00:00 GMTgit-disclosuregit-dumperghost-cmscve-2023-40028symlinkarbitrary-file-readinformation-disclosurepassword-reusesshtoctourace-conditionsudohttps://writeups.amvatlabs.com/htb/networked/https://writeups.amvatlabs.com/htb/networked/A file-upload form validates image extension and MIME magic bytes but permits a PHP double extension, which an Apache handler misconfiguration executes, yielding a shell as www-data. A cron job running as guly passes uploaded filenames unsanitised to exec(), so a filename containing shell metacharacters achieves command injection and a shell as guly. guly may run a network-configuration script as root that reads interface values into a config file, and a known ifcfg script-injection flaw turns those values into root command execution.Thu, 05 Nov 2026 00:00:00 GMTfile-upload-bypassdouble-extensionapache-misconfigurationmagic-bytesrcecommand-injectioncronsudoseclistshttps://writeups.amvatlabs.com/htb/usage/https://writeups.amvatlabs.com/htb/usage/A blog's password-reset form is vulnerable to SQL injection, which dumps and cracks the admin bcrypt hash. The admin panel runs a vulnerable Laravel-admin (CVE-2023-24249) whose avatar upload is bypassed by tampering the multipart filename in Burp to land a PHP webshell, giving a shell as dash. A reused password in dash's .monitrc grants SSH as xander, who can run a custom root binary that invokes 7-Zip with an unquoted wildcard; a crafted @-listfile symlink leaks root's private SSH key.Thu, 05 Nov 2026 00:00:00 GMTsql-injectionsqlmapbcryptlaravel-admincve-2023-24249file-upload-bypassrceinformation-disclosurepassword-reusessh7zipwildcard-injectionsudohttps://writeups.amvatlabs.com/htb/boardlight/https://writeups.amvatlabs.com/htb/boardlight/A Dolibarr CRM on a hidden vhost runs on default admin credentials and is vulnerable to authenticated PHP code injection (CVE-2023-30253), giving a shell as www-data. Its config file leaks database credentials reused for SSH as larissa. A SUID enlightenment binary is vulnerable to CVE-2022-37706, which is abused for a root shell.Mon, 02 Nov 2026 00:00:00 GMTdolibarrcve-2023-30253php-code-injectionrceinformation-disclosurepassword-reusesshenlightenmentcve-2022-37706suidhttps://writeups.amvatlabs.com/htb/keeper/https://writeups.amvatlabs.com/htb/keeper/A Request Tracker instance uses default admin credentials, and a user's comment leaks the lnorgaard SSH password. A KeePass database dump is cracked with CVE-2023-32784 to recover the master password, and the vault yields root's PuTTY private key, which is converted to an OpenSSH key for a root shell.Fri, 30 Oct 2026 00:00:00 GMTrequest-trackerdefault-credentialsinformation-disclosurepassword-reusekeepasscve-2023-32784kpcliputtyssh-keyhttps://writeups.amvatlabs.com/htb/soccer/https://writeups.amvatlabs.com/htb/soccer/Default credentials open a vulnerable Tiny File Manager (CVE-2021-45010), whose writable uploads directory gives a PHP reverse shell as www-data. The nginx config reveals a soc-player vhost vulnerable to a WebSocket-based blind SQL injection, which dumps SSH credentials for player. A doas rule allowing dstat is abused with a malicious Python plugin to spawn a root shell.Thu, 29 Oct 2026 00:00:00 GMTtiny-file-managerdefault-credentialscve-2021-45010file-uploadrcevhostwebsocketsql-injectionsqlmapdoasdstathttps://writeups.amvatlabs.com/htb/dog/https://writeups.amvatlabs.com/htb/dog/An exposed .git directory leaks the Backdrop CMS database password, which logs us into the admin panel. An authenticated module-upload flaw gives RCE as www-data, the leaked password is reused for SSH as johncusack, and a sudo-allowed bee command evaluates PHP as root.Sun, 25 Oct 2026 00:00:00 GMTbackdrop-cmsexposed-gitgit-dumperinformation-disclosurepassword-reusefile-uploadrcesudobeehttps://writeups.amvatlabs.com/htb/broker/https://writeups.amvatlabs.com/htb/broker/An outdated Apache ActiveMQ broker is vulnerable to unauthenticated RCE (CVE-2023-46604), giving a shell as activemq. A sudo rule allowing nginx to be run as root is abused — a malicious config turns nginx into a WebDAV server that writes an SSH key into root's authorized_keys for a root login.Sat, 24 Oct 2026 00:00:00 GMTapache-activemqcve-2023-46604openwiredeserializationrcesudonginxwebdavsshhttps://writeups.amvatlabs.com/htb/help/https://writeups.amvatlabs.com/htb/help/A GraphQL API on port 3000 leaks HelpDeskZ credentials through introspection; the cracked password logs us into the help desk, whose unauthenticated arbitrary file upload yields a reverse shell. An outdated kernel is then exploited with CVE-2017-16995 for root.Fri, 23 Oct 2026 00:00:00 GMTgraphqlintrospectionhelpdeskzarbitrary-file-uploadsql-injectionreverse-shellkernel-exploitcve-2017-16995https://writeups.amvatlabs.com/htb/sau/https://writeups.amvatlabs.com/htb/sau/A Request Baskets instance is vulnerable to SSRF (CVE-2023-27163), which we use to reach a firewalled Maltrail service. Maltrail's unauthenticated command injection gives a reverse shell as puma, and a sudo-allowed systemctl status is escalated to root through its pager.Thu, 22 Oct 2026 00:00:00 GMTssrfcve-2023-27163request-basketsmaltrailcommand-injectionsudosystemctlgtfobinshttps://writeups.amvatlabs.com/htb/updown/https://writeups.amvatlabs.com/htb/updown/A leaked .git directory on a dev vhost exposes source code guarded by a custom HTTP header; a file-upload filter is bypassed with the phar:// wrapper for RCE as www-data, a SUID script that pipes input into Python 2's input() escalates to the developer user, and a passwordless sudo easy_install hands over root.Thu, 22 Oct 2026 00:00:00 GMTvhost-enumgit-dumperlfipharfile-uploadpython2-inputsuideasy_installsudohttps://writeups.amvatlabs.com/htb/busqueda/https://writeups.amvatlabs.com/htb/busqueda/Command injection in the Searchor Python library gives a foothold as svc, reused Git credentials unlock a local Gitea instance, and a root-run checkup script that calls a script by relative path is hijacked for RCE as root.Sat, 17 Oct 2026 00:00:00 GMTcommand-injectionsearchorgiteasudorelative-path