0xdf Hacks / 0xdf Hacks is on Nostr

Independent automated RSS/Atom links about Detailed, original cybersecurity/HTB challenge walkthroughs, from 0xdf hacks stuff. Original creators are credited at the source; follow original links. Zaps support the independent feed operator.

Last Notes

2026-10-18 03:05:05 UTC

HTB: Eloquia
Eloquia is a Windows box hosting a Django blogging platform that supports OAuth login through a Google clone. I’ll find an AngularJS template injection in article bodies and use AngularJS directives to bypass the content security policy. With that, I’ll get admin access to the site two ways, by stealing the admin bot’s cookie and by abusing the OAuth flow to link the admin’s account to an account I control. As admin, I’ll upload a malicious SQLite extension through the Django admin panel and load it from the SQL Explorer to get a shell. I’ll use Python to decrypt saved Edge passwords with DPAPI and pivot to the next user. That user can write to the folder of a prototype .NET service that runs as SYSTEM, which I’ll abuse three ways, with an AppDomainManager injection in its config file, a DLL hijack, and breaking the service so I can overwrite its executable.
https://0xdf.gitlab.io/2026/10/17/htb-eloquia.html
#htb #eloquia #django #sqlexplorer #oauth #angularjs #net #system #edge #dll
#rss #feeds #linksharing #qwibbit

2026-10-16 03:59:35 UTC

HTB: DevHub
DevHub is a box built around MCP servers, the protocol that AI agents use to reach tools. I’ll find an MCPJam inspector listening on all interfaces and abuse an unauthenticated endpoint that spawns a process from an attacker-supplied command, getting remote code execution and a shell. From there I’ll find a Jupyter Lab instance bound to localhost with its access token sitting in both the systemd service file and the process list, and tunnel in to pivot to the next user. That user holds the API key for an internal MCP server running as root, which offers an undocumented tool that dumps root’s private SSH key.
https://0xdf.gitlab.io/2026/10/10/htb-devhub.html