HTB — Checker

TeamCity authentication bypass combined with Bookstack SSRF to read internal files and chain into remote code execution.

February 22, 2025HackTheBox

#TeamCity#SSRF#Bookstack#RCE

user.txt

reader@checker:~$ ls
user.txt
reader@checker:~$ cat user.txt
a2f4d3b8720114331db12192504dd3f

reader@checker:~$ bash -p
bash-5.1# whoami
root
bash-5.1# cd /root
bash-5.1# ls
root.txt
bash-5.1# cat root.txt
261df822...

Up next

HTB — Cypher

Neo4j Cypher injection bypasses authentication. APOC procedure abuse executes OS commands for initial access and privesc.

HTB — Dog

Backdrop CMS with exposed .git repository leaks DB credentials. Password reuse for SSH. SUID bee binary grants root.

HTB — TheFrizz

Active Directory machine exploiting misconfigured LAPS and ACL abuse chain to escalate from low-privileged user to Domain Admin.