HTB on the008Killer

HTB-Conversor

Sat, 21 Mar 2026 00:00:00 +0000

Overview

Category	Info
Machine Name	Conversor
Difficulty	Easy
Release Date	25 oct 2025
Author	fismathack
OS	Linux
Pwned Date	12 Nov 2025

Reconnaissance

Nmap Scan

nmap -sC -sV -oN nmap_initial.txt <target-ip>

Findings:

Port 22 — ssh
Port 80 — http

Web Analysis

We are given a login page which gives “Invalid credentials” response for invalid credentials. After registering a user we get into a page which converts XML files to asthetic formats using XSLT stylesheet.

HTB-Interpreter

Sat, 30 May 2026 00:00:00 +0000

Overview

Category	Info
Machine Name	Interpreter
Difficulty	Medium
Release Date	21 February, 2026
Author	ReziT
OS	Linux
Pwned Date	23 February, 2026

Enumeration

Port Scan

Initial enumeration revealed the following open ports:

PORT     STATE SERVICE  VERSION
22/tcp   open  ssh      OpenSSH 9.2p1 Debian 2+deb12u7 (protocol 2.0)
| ssh-hostkey: 
|   256 07:eb:d1:b1:61:9a:6f:38:08:e0:1e:3e:5b:61:03:b9 (ECDSA)
|_  256 fc:d5:7a:ca:8c:4f:c1:bd:c7:2f:3a:ef:e1:5e:99:0f (ED25519)
80/tcp   open  http     Jetty
|_http-title: Mirth Connect Administrator
| http-methods: 
|_  Potentially risky methods: TRACE
443/tcp  open  ssl/http Jetty
|_http-title: Mirth Connect Administrator
| http-methods: 
|_  Potentially risky methods: TRACE
| ssl-cert: Subject: commonName=mirth-connect
| Not valid before: 2025-09-19T12:50:05
|_Not valid after:  2075-09-19T12:50:05
|_ssl-date: TLS randomness does not represent time
6661/tcp open  unknown
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

The two localhost-only ports stood out immediately as targets for SSH tunneling after gaining a foothold.

HTB-Pterodactyl

Mon, 18 May 2026 00:00:00 +0000

🛠 Overview

Category	Info
Machine Name	Pterodactyl
Difficulty	Medium
Release Date	7 Feb 2026
Author	Headmonitor & TheCyberGeek
OS	Linux
Pwned Date	10 Feb 2026

1. Reconnaissance

Nmap Scan:

PORT     STATE  SERVICE    VERSION
22/tcp   open   ssh        OpenSSH 9.6 (protocol 2.0)
| ssh-hostkey: 
|   256 a3:74:1e:a3:ad:02:14:01:00:e6:ab:b4:18:84:16:e0 (ECDSA)
|_  256 65:c8:33:17:7a:d6:52:3d:63:c3:e4:a9:60:64:2d:cc (ED25519)
80/tcp   open   http       nginx 1.21.5
|_http-server-header: nginx/1.21.5
|_http-title: Did not follow redirect to http://pterodactyl.htb/
443/tcp  closed https
8080/tcp closed http-proxy

Scanning for the subdomains we get panel.pterodactyl.htb

$ ffuf -u http://pterodactyl.htb -H "Host:FUZZ.pterodactyl.htb"  -w /usr/share/wordlists/amass/bitquark_subdomains_top100K.txt -t 200 -fs 145

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://pterodactyl.htb
 :: Wordlist         : FUZZ: /usr/share/wordlists/amass/bitquark_subdomains_top100K.txt
 :: Header           : Host: FUZZ.pterodactyl.htb
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 200
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter           : Response size: 145
________________________________________________

panel                   [Status: 200, Size: 1897, Words: 490, Lines: 36, Duration: 415ms]
:: Progress: [100000/100000] :: Job [1/1] :: 675 req/sec :: Duration: [0:01:55] :: Errors: 0 ::

Add the IP to /etc/hosts as well as the subdomain

HTB-Expressway

Mon, 09 Mar 2026 00:00:00 +0000

🛠 Overview

Category	Info
Machine Name	Expressway
Difficulty	Easy
Release Date	20 Sep 2025
Author	dakkmaddy
OS	Linux
Pwned Date	21 Sep 2025

1. Reconnaissance

Initial reconnaissance was performed using RustScan to quickly identify open TCP ports on the target 10.10.11.87. RustScan results:

Open ports discovered:
- 22/tcp (SSH)

Observations from RustScan

Host responded to ICMP echo requests (TTL=63).
Only SSH was open over TCP.
File descriptor limits were noted to be low, suggesting potential speed issues in large scans.

A follow-up UDP scan revealed: