HackTheBox writeups and a searchable command reference.https://n0xshell.dev/https://n0xshell.dev/posts/fries/https://n0xshell.dev/posts/fries/From root on the web host, a PWM instance surfaces a crackable password hash, and abusing PWM's LDAP connection-test feature against our own Responder listener captures a service account's...Sat, 07 Nov 2026 00:00:00 GMThttps://n0xshell.dev/posts/port-scan-activity/https://n0xshell.dev/posts/port-scan-activity/Packet capture analysis of a network scan, from a single source IP sending a disproportionate number of requests across many destination ports and hosts. number of requests across many destination ports and hosts. The signature of an active scan rather than normal traffic.Wed, 04 Nov 2026 00:00:00 GMThttps://n0xshell.dev/posts/vulncicada/https://n0xshell.dev/posts/vulncicada/VulnCicada is a Windows Active Directory domain controller (DC-JPQ225.cicada.vl, domain cicada.vl) that leaks a set of usernames and a cleartext password through an anonymously mountable NFS...Wed, 04 Nov 2026 00:00:00 GMThttps://n0xshell.dev/posts/dooms-day/https://n0xshell.dev/posts/dooms-day/Log and packet analysis of a PHP and Apache exploit chain, from stalled multipart uploads that fill the worker pool to remote code execution.Sun, 01 Nov 2026 00:00:00 GMThttps://n0xshell.dev/posts/wordpresswebforensics/https://n0xshell.dev/posts/wordpresswebforensics/Splunk log analysis of a compromised WordPress site, from a WPScan scan and a brute-force on the login to a web shell planted in a theme file.Sun, 01 Nov 2026 00:00:00 GMThttps://n0xshell.dev/posts/timelapse/https://n0xshell.dev/posts/timelapse/Easy Windows DC: guest RID brute force, a cracked PFX for WinRM, a password in PowerShell history and a readable LAPS password.Sat, 31 Oct 2026 00:00:00 GMThttps://n0xshell.dev/posts/mirage/https://n0xshell.dev/posts/mirage/Mirage chains six separate low-severity issues into a full domain compromise.Sun, 25 Oct 2026 00:00:00 GMThttps://n0xshell.dev/posts/breach/https://n0xshell.dev/posts/breach/Kerberoasting and a forged Silver Ticket lead to MSSQL access, then SYSTEM via SeImpersonatePrivilege.Wed, 21 Oct 2026 00:00:00 GMThttps://n0xshell.dev/posts/checkpoint/https://n0xshell.dev/posts/checkpoint/Medium Windows AD box: a restored deleted account, a malicious VSIX on a share and a BadSuccessor path.Sun, 18 Oct 2026 00:00:00 GMThttps://n0xshell.dev/posts/reactor/https://n0xshell.dev/posts/reactor/Easy Linux box: unauthenticated React Flight RCE, a cracked hash for SSH and a root Node.js debugger on localhost.Sun, 18 Oct 2026 00:00:00 GMThttps://n0xshell.dev/posts/lustroustwo/https://n0xshell.dev/posts/lustroustwo/LustrousTwo is a hard-rated Windows box that deals with LDAP signing, channel binding, and disabled NTLM authentication.Sat, 17 Oct 2026 00:00:00 GMThttps://n0xshell.dev/posts/connected/https://n0xshell.dev/posts/connected/Locked HackTheBox writeup. Enter the root flag to read it.Mon, 24 Aug 2026 00:00:00 GMThttps://n0xshell.dev/prolabs/zephyr/zephyr-writeup/https://n0xshell.dev/prolabs/zephyr/zephyr-writeup/Locked Zephyr Prolab writeup. Enter the final lab flag to read it.Sun, 23 Aug 2026 00:00:00 GMThttps://n0xshell.dev/posts/logging/https://n0xshell.dev/posts/logging/Medium Windows AD box: credentials in logs, Shadow Credentials, a DLL hijack and a rogue WSUS server for SYSTEM.Tue, 05 May 2026 00:00:00 GMThttps://n0xshell.dev/posts/authority/https://n0xshell.dev/posts/authority/Medium Windows AD box: Ansible vault secrets, a PWM portal leaking LDAP credentials and ESC1 abuse over an LDAP shell.Sun, 12 Apr 2026 00:00:00 GMThttps://n0xshell.dev/posts/certified/https://n0xshell.dev/posts/certified/Medium Windows AD box: a WriteOwner and GenericWrite chain, Shadow Credentials for user access and ESC9 for Administrator.Sun, 12 Apr 2026 00:00:00 GMThttps://n0xshell.dev/posts/phantom/https://n0xshell.dev/posts/phantom/Medium Windows AD box: a password in an email PDF, a cracked VeraCrypt volume, a VyOS backup and RBCD with an SPN-less user.Sun, 12 Apr 2026 00:00:00 GMThttps://n0xshell.dev/posts/redelegate/https://n0xshell.dev/posts/redelegate/Hard Windows AD box: a KeePass vault from FTP, MSSQL RID brute force, ForceChangePassword and constrained delegation.Sun, 12 Apr 2026 00:00:00 GMT