Linux Privilege Escalation Cheatsheet
Quick reference commands — replace/expand with your own notes. # SUID binariesfind / -perm -4000 -type f 2>/dev/null# Sudo rightssudo -l# Cron jobscat /etc/crontab# Kernel versionuname -a Python reverse shell one-liner: import socket, subprocess, osdef connect(host, port): s = socket....
HTB: Down
Down is an easy Linux box (the first VulnLab → HTB migration) that hinges on a single primitive: escapeshellcmd() stops command injection but does nothing about argument injection. A website-uptime checker shells out to curl and nc with user input glued into the command string. I abuse curl’s mul...
Welcome to the blog
Welcome. This is r3vpwnx‘s red team blog — writeups, articles, and cheatsheets on offensive security, exploitation, and CTFs.
HTB: Redeemer
Redeemer is a Very Easy Linux machine that explores Redis database enumeration and exploitation. Redis is an in-memory database that can be misconfigured to allow unauthenticated access, potentially exposing sensitive data like flags or credentials. Path to root, at a glance: Scan the target → di...
HTB: Appointment
Appointment is a Very Easy Linux machine that introduces SQL Injection (SQLi) vulnerabilities in web applications. The machine runs a simple login page vulnerable to SQL injection, allowing authentication bypass and flag retrieval. Path to root, at a glance: Scan the target → discover port 80 (HT...
HTB: Sequel
Sequel is a Very Easy Linux machine that demonstrates the risks of misconfigured MySQL/MariaDB services allowing root access without a password. The machine showcases how to enumerate databases, tables, and extract sensitive information including flags through SQL queries. Path to root, at a...
HTB: Dancing
Dancing is a Very Easy Windows machine that introduces the Server Message Block (SMB) protocol and demonstrates the risks of misconfigured SMB shares allowing access without authentication. The machine has multiple open ports, including SMB (445/TCP) with a publicly accessible share containi...
HTB: Fawn
Fawn is a Very Easy Linux machine that demonstrates the security risks of FTP services with anonymous access enabled. The machine has only one open port (21/TCP - FTP) running vsftpd 3.0.3, which allows anonymous login and contains a flag file accessible without authentication. Path to root,...
HTB: Meow
Meow is a Very Easy Linux box that demonstrates the critical security risk of default credentials. The machine has only one open port (23/TCP - Telnet) and allows root login with a blank password.This exposes the fundamental principle that even a single misconfiguration can lead to complete ...