HackTheBox Magic machine writeup. SQL injection login bypass, double-extension PHP webshell upload, SUID binary PATH hijacking.

HackTheBox Brainfuck machine writeup. WordPress auth bypass, SMTP credentials pivot, Vigenère cipher, RSA root flag.

HackTheBox Shocker machine writeup. ShellShock (CVE-2014-6271) via CGI bash script, sudo perl privesc.

HackTheBox Lame machine writeup. Samba 3.0.20 username map script RCE and distcc CVE-2004-2687.

HackTheBox FriendZone machine writeup. DNS zone transfer, SMB credentials, LFI via pagename parameter, Python library hijacking.