HTB Blog

PwnOS: From Admin to Root—Exploiting CVE-2024-9474

diskordia, End_Of_File — Wed, 08 Oct 2025 04:00:00 GMT

What is CVE-2024-9474?
Skills you’ll use
Recon and fingerprinting
- PAN-OS fingerprinting
Exploitation flow
Flag retrieval (Demonstration)
Under the hood
- Defensive guidance
4 key takeaways
References

CyberJunkie explains: Data exfiltration via Windows Sandbox

CyberJunkie — Tue, 12 Aug 2025 04:00:00 GMT

The attack
Forensics and defense
Traditional artifacts vs Windows Sandbox Technique
Mitigations

Creating Linux Symbol Tables for Volatility: Step-by-step guide

Odysseus (c4n0pus) — Tue, 20 May 2025 04:00:00 GMT

Volatility was launched in 2007 by the Volatility Foundation and since then, it has grown to become the most advanced memory analysis and memory forensic framework in its category.

Unlock your potential as a SOC Analyst with HTB Academy's new Job Role Path

eleni — Wed, 23 Aug 2023 04:00:00 GMT

Are you new to the world of cybersecurity or an experienced professional looking to enhance your skills in line with industry standards?

UNIX socket injection to custom RCE POP chain - Spell Orsterra - UNI CTF 2022

Rayhan0x01 — Fri, 30 Dec 2022 05:00:00 GMT

Challenge summary 📄
Challenge motives 🧭
Challenge write-up ✍️
Application at-a-glance 🕵️
Application stack overview 🧩
Redis execution via socket injection 💉
PHP messenger component deserialization 🐘
Finding a custom POP chain 🔍
Exploiting deserialization via message queue 📥

Business CTF 2022: Defeating modern malware techniques - Mr Abilgate

Shad3 — Sat, 26 Nov 2022 05:00:00 GMT

Challenge summary
Determining the executable is packed and unpacking
Entropy
Size of the segments
Initial analysis
Decrypting the encrypted strings
Defeating function resolution
Defeating anti-debugging
Understanding the logic of the malware
Decrypting the .xls file

Business CTF 2022: Bleichenbacher's '06 RSA signature forgery - BBGun06

WizardAlfredo — Fri, 25 Nov 2022 05:00:00 GMT

Description 📄
The idea 💡
The application at-a-glance 🔍
Analyzing the source code 📖
- server.py
- encryption.py
Searching for the bugs 👾
Exploitation 🔓
Unintended solutions and patching 🧯
- Last-minute changes
- Maths gone wrong

Invalid curve attack - 400 Curves

WizardAlfredo — Sat, 19 Nov 2022 05:00:00 GMT

Description 📄
The Idea 💡
The application at-a-glance 🔍
Analyzing the source code 📖
- server.py
Searching for the bugs 👾
Exploitation 🔓

Chaining Self XSS with Cache Poisoning - Felonious Forums - Business CTF 2022

Rayhan0x01 — Fri, 18 Nov 2022 05:00:00 GMT

Challenge Summary 📄
Challenge Motives 🧭
Challenge Write-up ✍️
Application At-a-glance 🕵️
Figuring out the challenge goal 🎯
Reviewing source code in search for XSS 🔍
Chaining Self XSS with Cache Poisoning 🧪
Impacts as seen in the bug bounty reports 📝

Exploiting H2 Request Smuggling and SSTI - Phishtale - Business CTF 2022

Rayhan0x01 — Sat, 12 Nov 2022 05:00:00 GMT

Challenge Summary 📄
Challenge Motives 🧭
Challenge Write-up ✍️
Application At-a-glance 🕵️
HTTP/2 request smuggling in varnish 🐇
Bypassing ACL with the H2.CL Desync 🧱
Finding SSTI via source-code review 🔎
Digging into Twig Template Engine for RCE ⛏️
Bypassing Twig sandbox policy for RCE 📦
Impacts as seen in the bug bounty reports 📝
Past research on HTTPRS and SSTI 📖

HTB Blog

PwnOS: From Admin to Root—Exploiting CVE-2024-9474

Table of Contents

CyberJunkie explains: Data exfiltration via Windows Sandbox

Table of Contents

Creating Linux Symbol Tables for Volatility: Step-by-step guide

Unlock your potential as a SOC Analyst with HTB Academy's new Job Role Path

UNIX socket injection to custom RCE POP chain - Spell Orsterra - UNI CTF 2022

Table of Contents

Business CTF 2022: Defeating modern malware techniques - Mr Abilgate

Table of Contents

Business CTF 2022: Bleichenbacher's '06 RSA signature forgery - BBGun06

Table of Contents

Invalid curve attack - 400 Curves

Table of Contents

Chaining Self XSS with Cache Poisoning - Felonious Forums - Business CTF 2022

Table of Contents

Exploiting H2 Request Smuggling and SSTI - Phishtale - Business CTF 2022

Table of Contents