Exploring Cybersecurity, One Byte at a Time.

The FriendZone HackTheBox machine focuses on service enumeration, exploiting DNS misconfigurations, Local File Inclusion (LFI), and privilege escalation through Python library hijacking. Initial reconnaissance identifies exposed SMB shares allowing anonymous access, leading to the recovery of hardcoded administrative credentials. DNS zone transfer (AXFR) enumeration against port 53 reveals internal subdomains, including an administrative portal and a file upload host. Authenticating to the admin portal exposes an LFI vulnerability via the pagename URL parameter. By uploading a PHP reverse shell to the writable Development SMB share, LFI is leveraged to execute the payload and obtain initial shell access as www-data. Lateral movement to user friend is achieved by discovering plaintext MySQL credentials stored in a file and reusing them via SSH. Privilege escalation to root relies on monitoring background processes with pspy, which exposes a scheduled cron job running as root. Auditing local file permissions reveals that the system's core library is world-writable. Appending a reverse shell payload to os.py triggers execution when reporter.py imports the hijacked module, yielding full root access.

The Unlock Access with Azure Key Vault lab on PwnedLabs focuses on demonstrating cloud post-exploitation techniques within an Azure environment following an initial identity compromise. Practitioners learn how to leverage compromised user credentials to enumerate accessible cloud resources via the Azure CLI, discover misconfigured Azure Key Vault permissions, and extract plaintext secrets stored for contractor accounts. The lab further highlights lateral movement by exploiting a flawed external MFA provider to pivot to a higher-privileged consultant account. Finally, it illustrates how custom Azure RBAC roles with granular data-plane permissions can be analyzed to locate and exfiltrate sensitive customer data stored within Azure Storage tables.

AWS S3 Enumeration Basics lab is a PwnedLabs beginner lab that focuses on identifying, enumerating, and escalating privileges within AWS S3 infrastructure starting from a public web application footprint. Initial web reconnaissance against the website identifies static assets hosted directly out of the S3 bucket. Unauthenticated bucket listing reveals a publicly readable shared/ directory containing a zip, which yields a PowerShell script with embedded AWS access keys for the pam-test IAM identity. Authenticating as pam-test grants access to list restricted bucket prefixes, exposing an XML file. Parsing this XML file discloses valid production credentials for the it-admin IAM identity. Auditing the S3 bucket policy as it-admin reveals an explicit deny statement targeting pam-test for the admin/* prefix, which blocks pam-test from downloading sensitive files. Authenticating as it-admin bypasses this restriction, allowing successful retrieval of the flag.