Pterodactyl — HackTheBox Season 10 Walkthrough
A Minecraft panel hiding two CVEs and a SUSE-specific PAM trick — Pterodactyl chains a Laravel LFI into code execution, then escalates via a race-condition SUID mount flaw in udisks2.
Season 10
HackTheBox Season 10 machine walkthroughs — current-season boxes with detailed methodology, from web exploitation to Active Directory attack chains.
WingData — HackTheBox Season 10 Walkthrough
WingData chains two fresh CVEs — an unauthenticated RCE in Wing FTP Server and a Python tarfile filter bypass via PATH_MAX overflow — into a clean root. Don’t let the ‘Easy’ rating fool you.
Facts — HackTheBox Season 10 Walkthrough
Facts chains a Rails mass-assignment CVE in CamaleonCMS to admin access, leaks MinIO credentials hiding a backdoored SSH key, and escapes to root through Puppet’s facter tool — a satisfying end-to-end story about trusting your CMS too much.