↓ Skip to main content

HTB Writeups

2026

Fries (hard)

28 July 2026·4537 words·22 mins

Windows AD ADCS ESC7 ESC6 ESC16 NFS Userenum Responder Docker DACL-Abuse Linux

NanoCorp (hard)

20 June 2026·4461 words·21 mins

Windows AD Responder DACL-Abuse AV-Evasion File-Upload

MonitorsFour (easy)

23 May 2026·1888 words·9 mins

Windows Docker PHP API Type-Juggling

AirTouch (medium)

24 April 2026·2292 words·11 mins

Linux Wireless WPA2 WPA-Enterprise Wireshark SNMP File-Upload

Eighteen (easy)

12 April 2026·2330 words·11 mins

Windows AD MSSQL RID-Brute DMSA Kerberos Userenum

Conversor (easy)

22 March 2026·896 words·5 mins

Linux Flask Cronjob XSLT-Injection

Gavel (medium)

15 March 2026·1863 words·9 mins

Linux PHP UNIX-Socket Reverse-Engineering MYSQL SQL-Injection

Giveback (medium)

22 February 2026·4192 words·20 mins

Linux Wordpress Docker Kubernetes PHP-CGI RUNC

2025

Build (medium)

14 December 2025·3478 words·17 mins

Linux Git Rsync DNS Jenkins Rlogin

Breach (medium)

13 December 2025·2861 words·14 mins

Windows AD MSSQL NTLM-Theft SeImpersonate Silverticket

Delegate (medium)

12 December 2025·2519 words·12 mins

Windows AD DACL-Abuse Delegation Userenum

Forgotten (easy)

27 November 2025·2480 words·12 mins

Linux Docker MYSQL

Shibuya (hard)

17 November 2025·4121 words·20 mins

Windows AD Userenum Secretsdump Cross-Session RemotePotato Windows-Firewall ESC1 ADCS

Down (easy)

13 November 2025·1407 words·7 mins

Linux SSRF PHP Filter-Bypass Bruteforce LFI Docker

Reset (easy)

2 November 2025·1291 words·7 mins

Linux Logpoisoning PW-Reset Rlogin LFI

BabyTwo (medium)

1 November 2025·2824 words·14 mins

Windows RDP Userenum LoginScripts AD DACL-Abuse GPO

VulnEscape (easy)

27 October 2025·1122 words·6 mins

Windows RDP Kiosk UAC

Baby (easy)

25 October 2025·1081 words·6 mins

Windows AD Userenum SeBackup DCSync