/ tags/ NFS

# Remote

Hack-The-Box 55 / 72
6 min read

Windows Easy machine - Remote.

HTB Windows RCE ⓘ Remote Code Execution — the ability to run arbitrary commands on a target system remotely. Sudo ⓘ Linux command for running as another user — misconfigured sudo rules are a common privilege escalation path. Nmap ⓘ A network scanner used to enumerate open ports, services, and versions on a target. PHP FTP ⓘ File Transfer Protocol — frequently misconfigured with anonymous access, exposing sensitive files. SMB ⓘ Server Message Block — Windows file-sharing protocol, frequently abused for enumeration and lateral movement. NFS ⓘ Network File System — shared Linux file storage, sometimes exported with no_root_squash for privilege escalation.
Read

# Puppy

Hack-The-Box 54 / 72
8 min read

Windows Intermediate machine - Puppy.

HTB Active Directory ⓘ Microsoft's directory service for managing users, computers, and permissions across a Windows domain. Windows Sudo ⓘ Linux command for running as another user — misconfigured sudo rules are a common privilege escalation path. Nmap ⓘ A network scanner used to enumerate open ports, services, and versions on a target. DNS ⓘ The Domain Name System — translates hostnames to IPs; often leaks subdomains and internal naming during recon. PHP WinRM ⓘ Windows Remote Management — used for remote PowerShell access, often the lateral-movement endpoint on AD boxes. SMB ⓘ Server Message Block — Windows file-sharing protocol, frequently abused for enumeration and lateral movement. BloodHound ⓘ A tool that maps Active Directory trust relationships as a graph to reveal hidden attack paths to Domain Admin. LDAP ⓘ Lightweight Directory Access Protocol — used to query Active Directory; often vulnerable to injection or anonymous binds. Brute Force ⓘ Systematically trying many credential combinations until one succeeds. SUID ⓘ A Linux permission bit that runs a binary as its owner — misconfigured SUID binaries are a classic privesc vector. NFS ⓘ Network File System — shared Linux file storage, sometimes exported with no_root_squash for privilege escalation.
Read