Hack the Box - Craft

Craft is a medium Hack the Box machine and the whole thing is one mistake repeated four times. A public Gogs server holds the API source, the git history holds a working password, and a private repository holds the developer’s own SSH key, protected by a passphrase I had already dumped.

The bug is one line of Python that runs eval() on the ABV value of a beer. Every wrong attempt came back with the same useless error and the correct one came back as a 500. Root came from HashiCorp Vault, which hands out one-time root SSH passwords to any source address.

Hack the Box - Cap

Today we’re going to do ‘Cap ’ which is another easy hackthebox challenge. This will be similar to our previous challenge where we will go through without reviewing how it was done, then compare afterward with the solution.

Hack the Box - Code

Lets brush up our skills with HackTheBox! We’re starting with a simple retired machine called ‘Code ’. The total time to complete this challenge was just over six hours.