HackTheBox

Sorted by HTB Difficulty Rating & Order

Machines

Easy (Active)

1. ScriptKiddie: Metasploit APK Template Command Injection, sh -c Command Execution (TO REVIEW OFFICIAL WALKTHROUGH)
2. Delivery: Credentials through Bad Email Configuration, Privilege Escalation using HashCat (TO REVIEW OFFICIAL WALKTHROUGH)
3. Love: (TO REVIEW OFFICIAL WALKTHROUGH)

Easy (Retired)

1. Lame: Port 445 Netbios Samba Username Map Script Command Execution
2. Legacy: MS08_067 NetAPI Remote Code Execution Vulnerability
3. Devel: ASPX Reverse Shell (IIS) through FTP Upload
4. Beep: Port 443 VTigerCRM (Elastix) Local File Inclusion LFI Exploit, SSH through Credential Reuse
5. Optimum: Port 80 HFS 2.3 Remote Code Execution
6. Arctic: Port 8500 FMTP Adobe ColdFusion 8 Directory Traversal, JSP Reverse Shell through Task Scheduler
7. Grandpa: Port 80 Microsoft IIS WebDav ScStoragePathFromUrl Overflow
8. Granny: Port 80 Microsoft IIS WebDav ScStoragePathFromUrl Overflow
9. Bank: Port 80 Unencrypted Credentials discovered through GoBuster, SUID Privilege Escalation
10. Blocky: Port 80 Credentials discovered through GoBuster, SSH through Credential Reuse
11. Blue: MS17_010 EternalBlue
12. Mirai: Port 22 SSH with Default Password, Root Flag in USB Device
13. Shocker: Port 80 Shellshock Vulnerability
14. Sense:

Challenges

Easy