Jerry is a HackTheBox Easy difficulty machine that hosts an Apache Tomcat/7.0.88 application. The initial access involves using leaked credentials from a 403 error page on /host-manager/html to log in to the Tomcat Web Application Manager at /manager/html. Once authenticated, uploading and deploying a custom WAR archive grants an immediate reverse shell with NT AUTHORITY\SYSTEM privileges, bypassing the need for further privilege escalation and providing full administrative access to both flags simultaneously.

Silentium is a HackTheBox Easy difficulty machine that hosts a Flowise AI staging site that is vulnerable to multiple exploits. Initial foothold involves exploiting CVE-2025-58434 to bypass authentication on a user account, followed by leveraging CVE-2025-59528 for remote code execution to gain a container root shell. After extracting hardcoded SMTP credentials to SSH into the host as the user, privilege escalation to root is achieved by exploiting a PackageKit TOCTOU race condition (CVE-2026-41651).

Cronos is a HackTheBox Medium difficulty machine that hosts an admin panel that is vulnerable to SQL Injection. Initial foothold involves submitting a crafted payload that bypasses authentication, leading to command injection via the web ping utility to spawn a shell as www-data. Privilege escalation is achieved by locating a root cron job that runs Laravel's artisan script. Because www-data has write permissions to this file, injecting a reverse shell command into the script grants full root access.