$#pivoting

3 writeups

Grey hooded ghost mascot holding a laptop with a wifi signal icon

TryHackMeMedium06 Aug 2026

Hacker Holidays — Day 11: Infinity Pool

The same unsanitised shell=True command injection shows up twice on this box — first as a low-priv foothold via a "connectivity check" tool, then again in a root-owned automation service reached by pivoting through internal-only FreePBX and Chisel tunnels.

#hacker-holidays
#command-injection
#pivoting
#privesc

Two server towers wrapped in blue electric arcs

TryHackMeEasy01 Aug 2026

TryHackMe: Wreath

A three-host network pivot: a Webmin RCE foothold, chisel/socat relays into an isolated GitStack server and a personal PC, a leaked git repo revealing a file-upload webshell, PHP payload obfuscation for AV evasion, and an unquoted-service-path privesc to SYSTEM.

#pivoting
#av-evasion
#privesc
#rce

HackTheBoxMedium24 Jul 2026

HTB Academy: Password Attacks — Skills Assessment

Chained credential attacks across a segmented AD network: SSH user enumeration, cleartext creds in a Password Safe backup, a SOCKS pivot through a jump host, and an LSASS dump feeding a DCSync.

#active-directory
#password-attacks
#credential-access
#pivoting