Introduction: Cyber Apocalypse was an intermediate to expert level, 5 days CTF hosted by HackTheBox. It had around 60+ challenges divided into 7 categories. I was able to solve total of 8 challenges from different categories. This writeup is for the 4 web challenges that i solved. …

Lab Challenge:

Introduction: Dev Day CTF was held at FAST university, Karachi, in which our team Plugins secured third place while submitting all the flags. Challenges were divided into four categories and each category had four challenges varying in difficulty from easiest to hard. The four categories were: Web Exploitation Steganography Cryptography Reverse…

Introduction: Reel is a hard difficulty rated windows box from HackTheBox. It is an active directory based machine but it seems odd as kerberos service wasn’t running. Enumerating the ftp, we can login as anonymous and which contains some files out which a word document would give us an email. This…

Introduction: Blackfield is a hard-rated windows machine from hackthebox. It is based on an active directory environment. First, we get a list of usernames from publicly accessible SMB shares. One of them was the support user account, which has Kerberos pre-authentication disabled so with AS-REP roasting we get its credentials. Then…

Introduction: Forest is a windows active directory based room on HackTheBox. It’s rated somewhat between easy and medium. First, using enum4linux, we get a list of users. One of them was service account and usually they have pre-authentication disabled which leads to Kerberos AS-REP roasting. Basically, when disabled pre-authentication, we don’t…

Introduction: Active is a relatively easy retired machine from hack the box. As the name suggests, it’s based on windows active directory environment. It’s also listed in the TJ Null’s list for the OSCP like boxes. This box basically highlights the two basic problems in the active directory environment. First, the…

Introduction: Jerry is a relatively easy retired machine on hack the box. It is a windows based box and it’s also listed in the TJ Null’s list for OSCP preparation. First, we guess the default credentials of apache tomcat management panel and then get foothold by uploading malicious war file and…