https://satejchaudhari.com/writeups.html Offensive-security writeups: HackTheBox, Vulnhub, and lab builds. en Fri, 02 Oct 2026 00:00:00 GMT https://satejchaudhari.com/posts/2026-10-02-htb-monitorfour.html https://satejchaudhari.com/posts/2026-10-02-htb-monitorfour.html Fri, 02 Oct 2026 00:00:00 GMT HackTheBox A Cacti vhost, a leaked .env and an IDOR expose user hashes; CVE-2025-24367 gives an in-container shell; and an exposed Docker Engine API on the host is abused to escape to root. https://satejchaudhari.com/posts/2026-10-02-htb-nunchucks.html https://satejchaudhari.com/posts/2026-10-02-htb-nunchucks.html Fri, 02 Oct 2026 00:00:00 GMT HackTheBox A Nunjucks server-side template injection behind a vhost gives a reverse shell, and a Perl setuid capability combined with a weak AppArmor profile escalates to root. https://satejchaudhari.com/posts/2026-10-02-htb-babytwo.html https://satejchaudhari.com/posts/2026-10-02-htb-babytwo.html Fri, 02 Oct 2026 00:00:00 GMT HackTheBox A guest-readable share leaks a user list, a username=password spray gets a foothold, a writable SYSVOL logon script catches a user, and a BloodHound-guided ACL to GPO abuse chain reaches Domain Admin. https://satejchaudhari.com/posts/2026-10-02-htb-redelegate.html https://satejchaudhari.com/posts/2026-10-02-htb-redelegate.html Fri, 02 Oct 2026 00:00:00 GMT HackTheBox Anonymous FTP yields a KeePass database cracked with a hint-built wordlist; secrets spray into MSSQL and AD; a ForceChangePassword ACL takes over a user; and SeEnableDelegationPrivilege plus GenericAll on a computer is abused for constrained delegation with protocol transition to DCSync the domain. https://satejchaudhari.com/posts/2026-10-02-htb-rebound.html https://satejchaudhari.com/posts/2026-10-02-htb-rebound.html Fri, 02 Oct 2026 00:00:00 GMT HackTheBox To the user flag — a RID-brute user list feeds a no-pre-auth Kerberoast, a cracked service ticket is reused, and a BloodHound chain of group self-add and forced ACL inheritance resets a service account for the user flag. https://satejchaudhari.com/posts/2026-10-02-linux-namespaces-suricata-ids.html https://satejchaudhari.com/posts/2026-10-02-linux-namespaces-suricata-ids.html Fri, 02 Oct 2026 00:00:00 GMT Blue Team Building an isolated six-segment network from Linux namespaces, forcing every packet through an inline Suricata sensor, and writing per-subnet rules that detect and block SQL injection, anonymous FTP, SSH brute force, LDAP honeypot enumeration, and password spraying. https://satejchaudhari.com/posts/2026-10-02-adds-setup.html https://satejchaudhari.com/posts/2026-10-02-adds-setup.html Fri, 02 Oct 2026 00:00:00 GMT Active Directory A step-by-step build of an AD lab: installing the AD DS role, promoting a domain controller for a new forest, creating users, joining a client, and importing and linking the Windows 11 security-baseline GPO. https://satejchaudhari.com/posts/2026-08-18-osint-methodology.html https://satejchaudhari.com/posts/2026-08-18-osint-methodology.html Tue, 18 Aug 2026 00:00:00 GMT RECON A phase-by-phase OSINT workflow for an authorised red team engagement that starts with nothing but a domain name. https://satejchaudhari.com/posts/2026-07-03-VintageHTB.html https://satejchaudhari.com/posts/2026-07-03-VintageHTB.html Fri, 03 Jul 2026 00:00:00 GMT Active Directory Writeup for a Active Directory machine on HackTheBox. https://satejchaudhari.com/posts/2026-01-10-vulnhub-venom.html https://satejchaudhari.com/posts/2026-01-10-vulnhub-venom.html Sat, 10 Jan 2026 00:00:00 GMT Vulnhub A hash hidden in page source, an FTP foothold, a chain of encoded clues to a Subrion CMS 4.2.1 login, a public CMS exploit for the shell, and a wide-open sudo rule for root. https://satejchaudhari.com/posts/2026-01-10-vulnhub-matrix-1.html https://satejchaudhari.com/posts/2026-01-10-vulnhub-matrix-1.html Sat, 10 Jan 2026 00:00:00 GMT Vulnhub A base64-then-Brainfuck clue chain leaks a partial SSH password, crunch and hydra finish it, a vi restricted-shell escape gives a real shell, and a passwordless sudo rule gives root. https://satejchaudhari.com/posts/2026-01-10-vulnhub-matrix-2.html https://satejchaudhari.com/posts/2026-01-10-vulnhub-matrix-2.html Sat, 10 Jan 2026 00:00:00 GMT Vulnhub A robots.txt hint and an unauthenticated POST leak usernames, a cracked .htpasswd hash and a steghide-hidden password lead in, and a sudo-runnable gawk binary gives root. https://satejchaudhari.com/posts/2026-01-10-vulnhub-matrix-3.html https://satejchaudhari.com/posts/2026-01-10-vulnhub-matrix-3.html Sat, 10 Jan 2026 00:00:00 GMT Vulnhub A white-rabbit directory maze hides a crackable hash, a Windows binary reversed in Ghidra leaks SSH credentials, and two chained sudo rules walk the way to root. https://satejchaudhari.com/posts/2026-01-10-vulnhub-aragog.html https://satejchaudhari.com/posts/2026-01-10-vulnhub-aragog.html Sat, 10 Jan 2026 00:00:00 GMT Vulnhub A vulnerable WordPress File Manager plugin for the foothold, database credentials that crack a user's WordPress hash, and a writable root-run backup script for the root shell. https://satejchaudhari.com/posts/2026-01-10-vulnhub-grotesque-1.html https://satejchaudhari.com/posts/2026-01-10-vulnhub-grotesque-1.html Sat, 10 Jan 2026 00:00:00 GMT Vulnhub To the user flag — a WordPress password that is the MD5 of a song lyric, a reverse shell planted in the theme's 404.php, and credential reuse from wp-config.php to reach user.txt.