Manage - Java RMI misconfigured
ares@legion:~/HackTheBox/Manage$ sudo nmap -sVC -A -T4 $target Starting Nmap 7.95 ( https://nmap.org ) at 2025-11-22 12:21 EST Stats: 0:00:19 elapsed; 0 hosts completed (1 up), 1 undergoing Script ...
k0NN
Lock - Exposed Personal Access Token to aspx web shell and CVE
ares@legion:~/Documents$ sudo nmap -sVC -A -T4 $target Nmap scan report for 10.129.234.64 (10.129.234.64) Host is up (0.051s latency). Not shown: 996 filtered tcp ports (no-response) PORT STATE...
Jerry - CVE
Apache Tomcat 7.0.88 > Access Manager on webpage > login form > bruteforce > Malicious war upload > admin shell > flags in desktop type “2 for the price of 1.txt” use auxiliary/...
GoodGame - SQLi and SSTI
The page title is GoodGames and the footer discloses that the site runs on goodgames.htb . Let’s add this to our hosts file. 10.10.11.130 goodgames.htb Directory enumaration: ffuf -u http://10.1...
Expressway - VPN weak creds
No ouput from classic nmap scan > scan for udp ares@legion:~/HackTheBox/Expressway$ nmap -sU -T5 $target Starting Nmap 7.95 ( https://nmap.org ) at 2025-11-28 11:07 EST Warning: 10.129.45.91...
EscapeTwo - Active directory
ares@legion:~/HackTheBox/EscapeTwo$ sudo nmap -sVC -A -T4 10.129.63.50 Starting Nmap 7.95 ( https://nmap.org ) at 2025-11-16 14:00 EET Nmap scan report for 10.129.63.50 (10.129.63.50) Ho...
Driver - SMB config + weak creds
ares@legion:~$ sudo nmap -sV -A -T4 $target Starting Nmap 7.95 ( https://nmap.org ) at 2025-11-08 21:20 EET Nmap scan report for 10.10.11.106 (10.10.11.106) Host is up (0.077s latency). Not shown: ...
Down - SSRF Protocol Filter Bypass leading to Arbitrary File Read
ares@legion:~/HackTheBox/Down$ sudo nmap -sVC -A -T4 $target Starting Nmap 7.95 ( https://nmap.org ) at 2025-11-21 18:21 EST Nmap scan report for 10.129.234.87 (10.129.234.87) Host is up (0.047s la...
Devvortex - CVE
ares@legion:~$ sudo nmap -sV -A -T4 $target [sudo] password for ares: Starting Nmap 7.95 ( https://nmap.org ) at 2025-11-06 21:59 EET Nmap scan report for 10.10.11.242 (10.10.11.242) Host is up (0...
Conversor - XSLT injection to RCE
ares@legion:~$ sudo nmap -sVC -A -T4 -p- --min-rate 1000 $target Nmap scan report for 10.129.90.161 (10.129.90.161) Host is up (0.055s latency). Not shown: 65533 closed tcp ports (reset) PORT STA...