N0xshell
HackTheBox player and sysadmin working toward a career in red teaming. I publish HackTheBox machine and Sherlock writeups and keep a searchable reference of the commands I use.
Start Here
Machine · Hard · WindowsMirageMirage chains six separate low-severity issues into a full domain compromise. An unauthenticated NFS share leaks internal pentest documentation, which tips off two things: a DNS record that gets auto-purged and can be reclaimed, and the fact that NTLM is blocked domain-wide...
Machine · Medium · WindowsBreachBreach starts with an SMB share that allows guest access and turns out to be writable. I abused that to capture the NTLMv2 hash of a domain user and cracked it, which gave me a first set of valid credentials.
Machine · Medium · WindowsCheckpointCheckpoint is a medium-difficulty Windows Active Directory machine where we start with the credentials of a low privileged user. That user can restore a deleted domain account, which turns out to use the same password and has write access to an SMB share.
Machine · Easy · LinuxReactorReactor is an easy Linux machine that runs a Node.js web application on port 3000. The application is vulnerable to CVE-2025-55182, an unauthenticated remote code execution flaw in the React Flight decoder, which gives us a shell as the web server user.
Machine · Hard · WindowsLustrousTwoLustrousTwo is a hard-rated Windows box that deals with LDAP signing, channel binding, and disabled NTLM authentication. The box has a web server vulnerable to arbitrary file read, which helps attackers capture a Net-NTLMv2 hash for the service account, using it to request...
Machine · Medium · WindowsLoggingLogging is a medium Windows Active Directory machine where we start with the credentials of a low privileged user. A readable Logs share contains a trace file with the password of the svc_recovery service account, which only needs the year changing to work.
Machine · Medium · WindowsAuthorityAuthority is a medium Windows Active Directory machine. Guest access on SMB exposes a Development share with Ansible automation files, and the vault-encrypted values in them crack with ansible2john and John.
Machine · Medium · WindowsCertifiedCertified is a medium Windows Active Directory machine that starts with the credentials of a low privileged user. BloodHound shows that this user has WriteOwner over the Management group, so we take ownership, give ourselves full control and add ourselves to the group.
Machine · Medium · WindowsPhantomPhantom is a medium Windows Active Directory machine. A guest session on SMB gives us a public share with an email, and the base64 encoded PDF attached to it contains a default password.
Machine · Hard · WindowsRedelegateRedelegate is a hard Windows Domain Controller. Anonymous FTP exposes a KeePass database, and its master password follows the season and year pattern that a training agenda on the same server hints at.
Sherlock · Easy · DFIRPort Scan ActivityPacket capture analysis of a network scan, from a single source IP sending a disproportionate number of requests across many destination ports and hosts. number of requests across many destination ports and hosts. The signature of an active scan rather than normal traffic.
Sherlock · Easy · DFIRdOOMs DayThis Sherlock investigates the exploitation of an Apache and PHP web server. The attacker chained two PHP memory-handling vulnerabilities, using stalled multipart uploads to fill the worker pool and a leaked heap address to reach remote code execution.
Sherlock · Very Easy · DFIRWordpressWebForensicsSplunk log analysis of a compromised WordPress site, from a WPScan scan and a brute-force on the login to a web shell planted in a theme file.
Machine · 
Commands ReferenceCommands Reference
1,378 commands from my own writeups and notes, searchable by tool. AI helped extend and organise them.
Latest HackTheBox Writeups
Training & Certifications
Hacking labs and training, the source of the machines and Sherlocks in my writeups.
Offensive development and red team training with hands-on certifications.
Active Directory attack and red team labs, each with a hands-on certification exam.
Monitoring platform training, each with a hands-on certification exam.