1337 Sheets blog
Weekly Hack The Box writeups and offensive-security notes from the team behind the hardware.
HTB · Linux
August 29, 2026
active directory · HTB
August 8, 2026
Box: Cohort · OS: Linux (Ubuntu 24.04) · Difficulty: Easy Step 1 — Recon Goal: find the attack surface. sudo ip link set dev tun0 mtu 1300 # do this first, see note echo '<TARGET> cohort.htb' |
August 1, 2026
active directory · HTB
Difficulty: Hard · OS: Windows two-forest Active Directory, reached through a Linux edge host Chain: Handlebars AST type-confusion RCE → credential reuse → Gitea CI pipeline poisoning → service-
July 25, 2026
Add the vhosts to your hosts file before starting: echo "<TARGET> bedside.htb research.bedside.htb" | sudo tee -a /etc/hosts # HTB VPN frequently black-holes large outbound requests; lower the tunnel MTU to be safe sudo
July 18, 2026
1. Enumeration 1.1 Port scan nmap -p- --min-rate 5000 -T4 <TARGET> -oN nmap_allports.txt nmap -sC -sV -p22,80,1515 <TARGET> -oN nmap_services.txt 22/tcp open ssh OpenSSH 10.0p2 Ubuntu 5ubuntu5.4 80/tcp open http nginx 1.
July 11, 2026
Placeholders used Token Meaning $TARGET the target machine's IP $ATTACKER your VPN (tun0) IP $LPORT your reverse-shell listener port (e.g. 9001) [REDACTED] value intentionally removed 0. Setup & a network gotcha Add
June 28, 2026
OS: Linux · Difficulty: Hard · Theme: Cloud / AWS (LocalStack) misconfiguration Target <TARGET_IP> Attacker (tun0) <LHOST> /etc/hosts <TARGET_IP> nimbus.htb aws.nimbus.htb 0. Setup & the MTU black-hole (do this
June 20, 2026
HTB: Checkpoint — Detailed Writeup (redacted, command-by-command) Target: <target-ip> (DC01) · Attacker: <attacker-ip> (tun0) 0. Environment setup — two gotchas that will waste hours if missed Before a
June 13, 2026
Difficulty: Easy OS: Linux (CentOS 7) Reconnaissance Port Scan nmap -sV -sC -p- --min-rate 5000 <TARGET_IP> PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.4 (protocol 2.0) 80/tcp open http Apache httpd 2.4.6 ((Cent
June 7, 2026
HTB Machine: DevHub IP: <TARGET_IP> Attacker IP: <ATTACKER_IP> OS: Ubuntu 22.04.5 LTS Difficulty: Medium Category: Web / MCP Ecosystem / Lateral Movement Reconnaissance Port Scan nmap -Pn -T4 -sV -p- --min-rate 2000 <TAR
May 31, 2026
Box: Reactor OS: Linux Difficulty: Easy Target IP: <TARGET_IP> Attacker IP: <ATTACKER_IP> ( tun0 ) 1. Reconnaissance 1.1 Port Scan A full TCP port sweep followed by a targeted service/version scan: nmap -Pn -p- --min-rat
May 23, 2026
SmartHire — Walkthrough Machine Detail Value Name SmartHire Difficulty Medium OS Linux Date 05-16-2026 Introduction SmartHire is a Linux-based target that demonstrates the risks of outdated MLOps infrastructure an
May 21, 2026
HTB Write-up: Helix OS: Linux Difficulty: Medium 1. Executive Summary Helix is a lab that simulates a realistic industrial control systems (ICS/SCADA) environment. Target IP: [TARGET_IP] Attacker IP: [ATTACKER_IP] 2. Rec
May 21, 2026
active directory · Windows
Box Overview Difficulty: Hard | OS: Windows | Type: Active Directory (Multi-Forest) PingPong is a hard Active Directory machine featuring two forests bridged by a bidirectional trust: PING.HTB — DC1: dc1.ping.htb
April 25, 2026
Full archive at 1337sheets.com
