2026-10-16T02:26:13Z https://njump.cloud.vinney.xyz 0xdf Hacks https://njump.cloud.vinney.xyz/npub12nhjhydrhzfjfa9caqm45p6r80zewx33a0j9akxag4k069h6z9ws565xet https://cdn.jsdelivr.net/gh/twitter/twemoji@14.0.2/assets/72x72/1f58b.png https://cdn.jsdelivr.net/gh/twitter/twemoji@14.0.2/assets/72x72/1f58b.png https://njump.cloud.vinney.xyz/nevent1qqsw8afrtf3y7rj2a8w8zxzmmt2fqn530s4gzq0xl66um8mvdpquanszyp2w72u35wufxf85hr5rwks8gvaut9c6x847ghkcm4zkelgklgg460gweh3 HTB: Eloquia<br/><br/>Eloquia is a Windows box hosting a Django blogging platform that supports OAuth login through a Google clone. I’ll find an AngularJS template injection in article bodies and use AngularJS directives to bypass the content security policy. With that, I’ll get admin access to the site two ways, by stealing the admin bot’s cookie and by abusing the OAuth flow to link the admin’s account to an account I control. As admin, I’ll upload a malicious SQLite extension through the Django admin panel and load it from the SQL Explorer to get a shell. I’ll use Python to decrypt saved Edge passwords with DPAPI and pivot to the next user. That user can write to the folder of a prototype .NET service that runs as SYSTEM, which I’ll abuse three ways, with an AppDomainManager injection in its config file, a DLL hijack, and breaking the service so I can overwrite its executable.<br/><br/><a href="https://0xdf.gitlab.io/2026/10/17/htb-eloquia.html">https://0xdf.gitlab.io/2026/10/17/htb-eloquia.html</a><br/><br/>#htb #eloquia #django #sqlexplorer #oauth #angularjs #net #system #edge #dll<br/><br/>#rss #feeds #linksharing #qwibbit 2026-10-18T03:05:05Z https://njump.cloud.vinney.xyz/nevent1qqs0awse4vg0lqgdeywzjygg3p2erz57ce3rne3q92qclpu05lvn5xszyp2w72u35wufxf85hr5rwks8gvaut9c6x847ghkcm4zkelgklgg468kqtz0 HTB: DevHub<br/><br/>DevHub is a box built around MCP servers, the protocol that AI agents use to reach tools. I’ll find an MCPJam inspector listening on all interfaces and abuse an unauthenticated endpoint that spawns a process from an attacker-supplied command, getting remote code execution and a shell. From there I’ll find a Jupyter Lab instance bound to localhost with its access token sitting in both the systemd service file and the process list, and tunnel in to pivot to the next user. That user holds the API key for an internal MCP server running as root, which offers an undocumented tool that dumps root’s private SSH key.<br/><br/><a href="https://0xdf.gitlab.io/2026/10/10/htb-devhub.html">https://0xdf.gitlab.io/2026/10/10/htb-devhub.html</a> 2026-10-16T03:59:35Z