HTB Writeups

Hack The Box machines and challenges — recon, foothold, privesc.

touch 04 Oct 2026
Touch — Hack The Box Hack The Box · Windows · Web → SYSTEM Touch A kiosk box themed around airport check-in. An unauthenticated API endpoint hands over the device serial, the serial is...
Management 13 Sep 2026 · Medium · linuxopenamdeserializationrdiff-backuppassword-reuse
A managed-services provider: nginx fronting a small marketing site and an SSO portal, backed by a Java identity server (with its directory) and a service-desk database. Spoiler-light notes — no fl...
Cohort 02 Aug 2026 · linuxssrfwebsocketdbusprivescrace-condition
A small analytics SPA whose only interesting feature is a URL validator — and that validator turns out to be the thread that unwinds the whole host. Spoiler-light notes — no flags, credentials or ...
Bedside 19 Jul 2026 · Medium · linuxdeserializationpath-traversalcontainersprivesc
A medical-AI training platform. The chain is two separate deserialization bugs, bridged by a container that shares the host’s network stack — which is how a service the outside world can’t even rea...