Hack the Box - Craft

Craft is a medium Hack the Box machine and the whole thing is one mistake repeated four times. A public Gogs server holds the API source, the git history holds a working password, and a private repository holds the developer’s own SSH key, protected by a passphrase I had already dumped.

The bug is one line of Python that runs eval() on the ABV value of a beer. Every wrong attempt came back with the same useless error and the correct one came back as a 500. Root came from HashiCorp Vault, which hands out one-time root SSH passwords to any source address.

Hack Smarter - Slayer

Slayer is an easy Windows lab on Hack Smarter and it starts where most engagements end. A social engineering phase has already worked, and I am dropped in with a standard account and a working password on a Windows 11 build 26100 host. The win was a text file in the profile I already had. PowerShell logs every line you type, and whoever built this box set the local Administrator password from a session running as that same standard user. No exploit, one file read. Most of my hour still went into a privilege escalation that was not there at all.

Hack Smarter - Aftermath

Aftermath is an easy Linux lab on Hack Smarter. Three ports, one webmail app, and a privilege escalation that comes down to a single sudoers line.

Postfix still answers VRFY, which turns 499 names into one real account. That account logs into an unlinked Roundcube install, and Roundcube 1.5.9 is one release short of the fix for CVE-2025-49113. The shell that bug hands over may run apt-get as root.