Field notes
Writeups and technical notes.
Walkthroughs and references from controlled lab environments, with a focus on attack paths, technical decisions, and reusable lessons.
- Writeups
- 14
- Notes
- 1
- Access
- Public
14 results
Logging
Logging is a single-host Windows AD machine that pivots from a low-priv user to a service account in Protected Users (Kerberos-only), through a shadow-credential attack on a gMSA, into a…
Silentium
Silentium is a Linux box that ladders an unauth Flowise password-reset-token leak into authenticated Flowise admin, then into pre-auth-feeling code-exec inside a Flowise Docker container…
Snapped
Snapped is a Hard Linux machine running Nginx on port 80 with two virtual hosts - a static marketing site on snapped.htb and an Nginx UI admin panel on admin.snapped.htb. The Nginx UI…
DevArea
DevArea is a Linux machine running six services - FTP (anonymous login), SSH, an Apache web server hosting a static hiring platform, an Apache CXF SOAP service on Jetty (port 8080), and…
Kobold
Kobold is a Linux machine running three services - an nginx reverse proxy fronting a PrivateBin 2.0.2 instance, an MCPJam Inspector web application, and SSH. The wildcard TLS certificate…
Pterodactyl
Pterodactyl is a Linux machine running openSUSE Leap 15 with a Pterodactyl Panel game server management interface behind nginx. The main page at pterodactyl.htb shows a Minecraft server…
Pirate
Pirate is a multi-host Windows Active Directory machine simulating a realistic corporate environment. The domain controller DC01 is dual-homed, connecting to both the HTB VPN and an…
Azure Operator Reference
Consolidated Azure operator note covering connection flows, Azure AD enumeration, configuration review, and managed identity/API enumeration.
Overwatch
Overwatch is a Windows Server 2022 Domain Controller running a custom .NET WCF monitoring service. Guest-accessible SMB reveals a hidden software$ share containing the monitoring binary…
VariaType
VariaType is a Linux box running a Flask-based variable font generator backed by fonttools, alongside a PHP internal validation portal. Subdomain enumeration reveals portal.variatype.htb…
CCTV
CCTV is a Linux machine running ZoneMinder 1.37.63, an open-source video surveillance system. Default credentials (admin:admin) provide API access, and the default ZMAUTHHASHSECRET…
Facts
Facts is a Linux machine running CameleonCMS 2.9.0 (Ruby on Rails) with a MinIO/LocalStack S3 backend for media storage. Open user registration with CAPTCHA allows creating a…
WingData
WingData is a Linux machine running Wing FTP Server v7.4.3, vulnerable to CVE-2025-47812 - an unauthenticated Remote Code Execution via NULL-byte authentication bypass and Lua code…
VulnLab - Barrier
Barrier is a Linux machine running GitLab CE 17.3.2 with SAML authentication via authentik 2024.10.5, and Apache Guacamole for remote access management. The attack chain leverages a…
Interpreter
Interpreter is a Linux machine running Mirth Connect 4.4.0, a healthcare integration engine vulnerable to CVE-2023-43208 (pre-auth Remote Code Execution via Java deserialization).…
No entries in this collection yet.