Posts by chjwoo

• 

  HackTheBox Knife Walkthrough

  Knife is an easy Linux machine on HackTheBox that involves exploiting a backdoor in PHP 8.1.0-dev to gain initial access, followed by privilege escalation to root using a misconfigured sudo permission on the knife binary. This walkthrough covers reconnaissance, exploitation, and privilege escalation steps.

  c chjwoo

  October 30, 2025

  13 min read

  PHP Web Exploitation
• 

  HackTheBox Blue Walkthrough

  Blue is an easy Windows machine on HackTheBox that involves exploiting the well-known MS17-010 vulnerability in the SMB protocol to gain Remote Code Execution (RCE) and ultimately retrieve user and root flags. This walkthrough covers reconnaissance, exploitation using Metasploit, and post-exploitation steps.

  c chjwoo

  October 16, 2025

  6 min read

  SMB MS17-010
• 

  HackTheBox Nibbles Walkthrough

  Nibbles is an easy Linux machine on HackTheBox that involves exploiting an arbitrary file upload vulnerability in Nibbleblog to gain initial access, followed by privilege escalation to root. This walkthrough covers reconnaissance, exploitation, and privilege escalation steps.

  c chjwoo

  October 16, 2025

  4 min read

  Arbitrary File Upload
• 

  HackTheBox Bashed Walkthrough

  Bashed is an easy Linux machine on HackTheBox that involves exploiting a web application vulnerability to gain initial access, followed by privilege escalation to root. This walkthrough covers reconnaissance, exploitation, and privilege escalation steps.

  c chjwoo

  October 14, 2025

  4 min read

  Command Injection Web Exploitation
• 

  HackTheBox Lame Walkthrough

  Lame walkthrough focusing on exploiting the vsftpd 2.3.4 backdoor vulnerability to achieve Remote Code Execution (RCE) and privilege escalation to root using Samba 3.0.20 "username map script" command execution vulnerability.

  c chjwoo

  October 10, 2025

  5 min read

  RCE Vulnerability Assesment Samba
• 

  HackTheBox TwoMillion Walkthrough

  TwoMillion walkthrough focusing on exploiting an invite code generation mechanism and a command injection vulnerability to achieve Remote Code Execution (RCE) and privilege escalation to root using CVE-2023-0386.

  c chjwoo

  October 8, 2025

  9 min read

  Command Injection RCE Misconfiguration
• 

  HackTheBox BountyHunter Walkthrough

  BountyHunter walkthrough focusing on exploiting an XXE vulnerability in a bug reporting form to achieve Remote Code Execution (RCE) and privilege escalation to root.

  c chjwoo

  February 16, 2025

  10 min read

  XXE Injection Web Exploitation
• 

  HackTheBox Cap Walkthrough

  Cap is an easy Linux machine that runs an HTTP server with administrative functions including network capturing. Improper access control leads to Insecure Direct Object Reference (IDOR) allowing access to other users.

  c chjwoo

  February 9, 2025

  6 min read

  Digital Forensics IDOR Web Exploitation
• 

  HackTheBox Starting Point Writeups

  This is a detailed write-up of all my HackTheBox Starting Point machines. I will update this post as I complete more machines.

  c chjwoo

  February 6, 2025

  50 min read

  17 subposts

  HackTheBox Writeup
• 

  Hackfest0x05 CTF Writeup

  This is my writeup for the Hackfest0x05 CTF event.

  c chjwoo

  December 30, 2021

  9 min read

  2 subposts

  CTF Writeup