HTB: MakeSense MakeSense starts with a WordPress site for a web agency, with a voice call widget that transcribes recordings in the browser. I’ll find an audio file in a listable uploads directory where a user reads their password aloud, and use it to log in. That user can view contact submissions, so I’ll reverse engineer the encrypted voice channel to submit arbitrary transcriptions, using it for XSS against an administrator bot to create my own admin account and get a shell through the plugin editor. A password in the WordPress config gets me the next user. For root, I’ll abuse an OCR web app running as root that saves recognized text to any filename, drawing PHP into an image to get execution. In Beyond Root I’ll look at the bot that didn’t care about mixed content, and how exactly a backdoored WordPress plugin gets triggered. https://0xdf.gitlab.io/2026/10/31/htb-makesense.html #htb #makesense #root #wordpress #xss #php #rss #feeds #linksharing #qwibbit

HTB: Checkpoint Checkpoint is an assume breach Active Directory box where the starting account has unusual rights over the AD Recycle Bin. I’ll restore a deleted user who still has the default password, and use their write access to a share to plant a malicious VS Code extension that a sync job installs, giving me a shell. BadSuccessor is patched on this domain controller, but I’ll show that the BetterSuccessor technique still works when I can write to the target account, which gets me its NTLM hash. That account can read a share of VMware backups, where I’ll use vmkatz to pull an administrator hash from a memory snapshot, which turns out to be reused by the domain Administrator. https://0xdf.gitlab.io/2026/10/24/htb-checkpoint.html #htb #checkpoint #recyclebin #activedirectory #administrator #code #rss #feeds #linksharing #qwibbit

HTB: Eloquia Eloquia is a Windows box hosting a Django blogging platform that supports OAuth login through a Google clone. I’ll find an AngularJS template injection in article bodies and use AngularJS directives to bypass the content security policy. With that, I’ll get admin access to the site two ways, by stealing the admin bot’s cookie and by abusing the OAuth flow to link the admin’s account to an account I control. As admin, I’ll upload a malicious SQLite extension through the Django admin panel and load it from the SQL Explorer to get a shell. I’ll use Python to decrypt saved Edge passwords with DPAPI and pivot to the next user. That user can write to the folder of a prototype .NET service that runs as SYSTEM, which I’ll abuse three ways, with an AppDomainManager injection in its config file, a DLL hijack, and breaking the service so I can overwrite its executable. https://0xdf.gitlab.io/2026/10/17/htb-eloquia.html #htb #eloquia #django #sqlexplorer #oauth #angularjs #net #system #edge #dll #rss #feeds #linksharing #qwibbit

HTB: DevHub DevHub is a box built around MCP servers, the protocol that AI agents use to reach tools. I’ll find an MCPJam inspector listening on all interfaces and abuse an unauthenticated endpoint that spawns a process from an attacker-supplied command, getting remote code execution and a shell. From there I’ll find a Jupyter Lab instance bound to localhost with its access token sitting in both the systemd service file and the process list, and tunnel in to pivot to the next user. That user holds the API key for an internal MCP server running as root, which offers an undocumented tool that dumps root’s private SSH key. https://0xdf.gitlab.io/2026/10/10/htb-devhub.html