http://freedie.org/tags/sudo/Recent content in Sudo on Freedie | Penetration Testing Lab WriteupsHugoen-usFri, 12 Jun 2026 19:40:40 -0400http://freedie.org/htb-writeups/linkvortex/Fri, 12 Jun 2026 19:40:40 -0400http://freedie.org/htb-writeups/linkvortex/https://www.hackthebox.com/machines/LinkVortex OS: Linux 10.129.231.194 Credentials: Username Password Notes/Hash admin@linkvortex.htb OctopiFociPilfer45 leaked credential from git repository bob fibber-talented-worth from arbitrary file read nmap results: # Nmap 7.99 scan initiated Fri Jun 12 11:57:48 2026 as: /usr/lib/nmap/nmap -p- --open -sC -sV -A -vv -oA nmap/LinkVortex 10.129.231.194 Nmap scan report for 10.129.231.194 Host is up, received reset ttl 63 (0.018s latency). Scanned at 2026-06-12 11:57:49 EDT for 21s Not shown: 65466 closed tcp ports (reset), 67 filtered tcp ports (no-response) Some closed ports may be reported as filtered due to --defeat-rst-ratelimit PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack ttl 63 OpenSSH 8.http://freedie.org/htb-writeups/editorial/Fri, 12 Jun 2026 02:13:38 -0400http://freedie.org/htb-writeups/editorial/https://www.hackthebox.com/machines/Editorial OS: Linux 10.129.15.185 Credentials: Username Password Notes/Hash dev dev080217_devAPI!@ leaked password from vulnerable SSRF api prod 080217_Producti0n_2023!@ from git enumeration in dev home directory nmap results: # Nmap 7.99 scan initiated Thu Jun 11 22:59:02 2026 as: /usr/lib/nmap/nmap -p- --open -sC -sV -A -vv -oA nmap/Editorial 10.129.15.185 Nmap scan report for 10.129.15.185 Host is up, received reset ttl 63 (0.016s latency). Scanned at 2026-06-11 22:59:02 EDT for 21s Not shown: 65289 closed tcp ports (reset), 244 filtered tcp ports (no-response) Some closed ports may be reported as filtered due to --defeat-rst-ratelimit PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack ttl 63 OpenSSH 8.http://freedie.org/htb-writeups/sunday/Thu, 11 Jun 2026 18:33:11 -0400http://freedie.org/htb-writeups/sunday/https://www.hackthebox.com/machines/Sunday OS: 10.129.15.113 Credentials: Username Password Notes/Hash sunny sunday guessing password after obtain username from finger sammy cooldude! cracked password from /backup/shadow.bak nmap results: # Nmap 7.99 scan initiated Thu Jun 11 15:38:04 2026 as: /usr/lib/nmap/nmap -p- --open -sC -sV -A -vv -oA nmap/Sunday 10.129.15.113 Nmap scan report for 10.129.15.113 Host is up, received reset ttl 63 (0.017s latency). Scanned at 2026-06-11 15:38:05 EDT for 190s Not shown: 62534 filtered tcp ports (no-response), 2996 closed tcp ports (reset) Some closed ports may be reported as filtered due to --defeat-rst-ratelimit PORT STATE SERVICE REASON VERSION 79/tcp open finger?http://freedie.org/htb-writeups/cozyhosting/Tue, 09 Jun 2026 14:39:40 -0400http://freedie.org/htb-writeups/cozyhosting/https://www.hackthebox.com/machines/CozyHosting OS: Linux 10.129.229.88 Credentials: Username Password Notes/Hash josh manchesterunited from cracking hahes from database nmap results: # Nmap 7.99 scan initiated Tue Jun 9 11:26:24 2026 as: /usr/lib/nmap/nmap -p- --open -sC -sV -A -vv -oA nmap/CozyHosting 10.129.229.88 Nmap scan report for 10.129.229.88 Host is up, received echo-reply ttl 63 (0.020s latency). Scanned at 2026-06-09 11:26:25 EDT for 20s Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack ttl 63 OpenSSH 8.http://freedie.org/htb-writeups/precious/Mon, 08 Jun 2026 02:11:29 -0400http://freedie.org/htb-writeups/precious/https://www.hackthebox.com/machines/Precious OS: 10.129.228.98 Credentials: Username Password Notes/Hash henry Q3c1AqGHtoI0aXAYFH found in a config file in ruby’s home directory nmap results: # Nmap 7.99 scan initiated Sun Jun 7 23:09:19 2026 as: /usr/lib/nmap/nmap -p- --open -sC -sV -A -vv -oA nmap/Precious 10.129.228.98 Nmap scan report for 10.129.228.98 Host is up, received echo-reply ttl 63 (0.015s latency). Scanned at 2026-06-07 23:09:19 EDT for 18s Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack ttl 63 OpenSSH 8.http://freedie.org/htb-writeups/devvortex/Sun, 07 Jun 2026 22:31:29 -0400http://freedie.org/htb-writeups/devvortex/https://www.hackthebox.com/machines/Devvortex OS: Linux 10.129.229.146 Credentials: Username Password Notes/Hash lewis P4ntherg0t1n5r3c0n## dumped from joomla exploit nmap results: # Nmap 7.99 scan initiated Sun Jun 7 19:40:01 2026 as: /usr/lib/nmap/nmap -p- --open -sC -sV -A -vv -oA nmap/Devvortex 10.129.229.146 Nmap scan report for 10.129.229.146 Host is up, received reset ttl 63 (0.016s latency). Scanned at 2026-06-07 19:40:02 EDT for 19s Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack ttl 63 OpenSSH 8.http://freedie.org/htb-writeups/bashed/Wed, 03 Jun 2026 10:50:00 -0400http://freedie.org/htb-writeups/bashed/https://www.hackthebox.com/machines/Bashed OS: Ubuntu 10.129.186.17 Credentials: Username Password nmap results: 80/tcp open http syn-ack ttl 63 Apache httpd 2.4.18 ((Ubuntu)) |_http-favicon: Unknown favicon MD5: 6AA5034A553DFA77C3B2C7B4C26CF870 |_http-title: Arrexel's Development Site | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS |_http-server-header: Apache/2.4.18 (Ubuntu) Device type: general purpose Running: Linux 3.X|4.X OS CPE: cpe:/o:linux:linux_kernel:3 cpe Attack + Enum Vectors: (Ports, etc.) TCP 80: HTTP Web Service Enum: Gobuster / wfuzz after enuming with gobuster: we found a /dev directory with web shellhttp://freedie.org/htb-writeups/broker/Mon, 01 Jun 2026 23:49:11 -0400http://freedie.org/htb-writeups/broker/https://www.hackthebox.com/machines/Broker OS: Linux 10.129.230.87 Credentials: Username Password nmap results: PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack ttl 63 OpenSSH 8.9p1 Ubuntu 3ubuntu0.4 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 3e:ea:45:4b:c5:d1:6d:6f:e2:d4:d1:3b:0a:3d:a9:4f (ECDSA) | ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJ+m7rYl1vRtnm789pH3IRhxI4CNCANVj+N5kovboNzcw9vHsBwvPX3KYA3cxGbKiA0VqbKRpOHnpsMuHEXEVJc= | 256 64:cc:75:de:4a:e6:a5:b4:73:eb:3f:1b:cf:b4:e3:94 (ED25519) |_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOtuEdoYxTohG80Bo6YCqSzUY9+qbnAFnhsk4yAZNqhM 80/tcp open http syn-ack ttl 63 nginx 1.18.0 (Ubuntu) | http-auth: | HTTP/1.1 401 Unauthorized\x0D |_ basic realm=ActiveMQRealm |_http-title: Error 401 Unauthorized |_http-server-header: nginx/1.18.0 (Ubuntu) 1883/tcp open mqtt syn-ack ttl 63 | mqtt-subscribe: | Topics and their most recent payloads: | ActiveMQ/Advisory/MasterBroker: |_ ActiveMQ/Advisory/Consumer/Topic/#: 5672/tcp open amqp?