<!DOCTYPE html> <html lang="en-US"> <head> <meta charset="UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=Edge"> <link rel="stylesheet" href="/htb-writeups/assets/css/just-the-docs-default.css"> <link rel="stylesheet" href="/htb-writeups/assets/css/just-the-docs-head-nav.css" id="jtd-head-nav-stylesheet"> <style id="jtd-nav-activation"> .site-nav ul li a { background-image: none; } </style> <script src="/htb-writeups/assets/js/vendor/lunr.min.js"></script> <script src="/htb-writeups/assets/js/just-the-docs.js"></script> <meta name="viewport" content="width=device-width, initial-scale=1"> <!-- Begin Jekyll SEO tag v2.8.0 --> <title>HTB Writeups | The most comprehensive Hack The Box writeup collection - 500+ machines, 400+ challenges, ProLabs, Sherlocks, CTF events, cheatsheets, and OSCP/CPTS/CRTO certification prep.</title> <meta name="generator" content="Jekyll v4.4.1" /> <meta property="og:title" content="HTB Writeups" /> <meta property="og:locale" content="en_US" /> <meta name="description" content="The most comprehensive Hack The Box writeup collection - 500+ machines, 400+ challenges, ProLabs, Sherlocks, CTF events, cheatsheets, and OSCP/CPTS/CRTO certification prep." /> <meta property="og:description" content="The most comprehensive Hack The Box writeup collection - 500+ machines, 400+ challenges, ProLabs, Sherlocks, CTF events, cheatsheets, and OSCP/CPTS/CRTO certification prep." /> <link rel="canonical" href="https://momenbasel.github.io/htb-writeups/assets/css/just-the-docs-head-nav.css" /> <meta property="og:url" content="https://momenbasel.github.io/htb-writeups/assets/css/just-the-docs-head-nav.css" /> <meta property="og:site_name" content="HTB Writeups" /> <meta property="og:type" content="website" /> <meta name="twitter:card" content="summary" /> <meta property="twitter:title" content="HTB Writeups" /> <script type="application/ld+json"> {"@context":"https://schema.org","@type":"WebPage","description":"The most comprehensive Hack The Box writeup collection - 500+ machines, 400+ challenges, ProLabs, Sherlocks, CTF events, cheatsheets, and OSCP/CPTS/CRTO certification prep.","headline":"HTB Writeups","publisher":{"@type":"Organization","logo":{"@type":"ImageObject","url":"https://momenbasel.github.io/htb-writeups/assets/images/logo.svg"}},"url":"https://momenbasel.github.io/htb-writeups/assets/css/just-the-docs-head-nav.css"}</script> <!-- End Jekyll SEO tag --> <link rel="stylesheet" href="/htb-writeups/assets/css/custom.css"> <meta property="og:image" content="https://momenbasel.github.io/htb-writeups/assets/images/social-preview.svg"> <meta property="og:title" content="HTB Writeups - The Ultimate Hack The Box Resource"> <meta property="og:description" content="500+ machines, 400+ challenges, ProLabs, Sherlocks, skill trees, attack paths, and certification prep. Interactive knowledge graph and machine finder."> <meta name="twitter:card" content="summary_large_image"> <meta name="twitter:image" content="https://momenbasel.github.io/htb-writeups/assets/images/social-preview.svg"> </head> <body> <a class="skip-to-main" href="#main-content">Skip to main content</a> <svg xmlns="http://www.w3.org/2000/svg" class="d-none"> <symbol id="svg-link" viewBox="0 0 24 24"> <title>Link</title> <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="feather feather-link"> <path d="M10 13a5 5 0 0 0 7.54.54l3-3a5 5 0 0 0-7.07-7.07l-1.72 1.71"></path><path d="M14 11a5 5 0 0 0-7.54-.54l-3 3a5 5 0 0 0 7.07 7.07l1.71-1.71"></path> </svg> </symbol> <symbol id="svg-menu" viewBox="0 0 24 24"> <title>Menu</title> <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="feather feather-menu"> <line x1="3" y1="12" x2="21" y2="12"></line><line x1="3" y1="6" x2="21" y2="6"></line><line x1="3" y1="18" x2="21" y2="18"></line> </svg> </symbol> <symbol id="svg-arrow-right" viewBox="0 0 24 24"> <title>Expand</title> <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="feather feather-chevron-right"> <polyline points="9 18 15 12 9 6"></polyline> </svg> </symbol> <!-- Feather. MIT License: https://github.com/feathericons/feather/blob/master/LICENSE --> <symbol id="svg-external-link" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="feather feather-external-link"> <title id="svg-external-link-title">(external link)</title> <path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"></path><polyline points="15 3 21 3 21 9"></polyline><line x1="10" y1="14" x2="21" y2="3"></line> </symbol> <symbol id="svg-doc" viewBox="0 0 24 24"> <title>Document</title> <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="feather feather-file"> <path d="M13 2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V9z"></path><polyline points="13 2 13 9 20 9"></polyline> </svg> </symbol> <symbol id="svg-search" viewBox="0 0 24 24"> <title>Search</title> <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="feather feather-search"> <circle cx="11" cy="11" r="8"></circle><line x1="21" y1="21" x2="16.65" y2="16.65"></line> </svg> </symbol> <!-- Bootstrap Icons. MIT License: https://github.com/twbs/icons/blob/main/LICENSE.md --> <symbol id="svg-copy" viewBox="0 0 16 16"> <title>Copy</title> <svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" fill="currentColor" class="bi bi-clipboard" viewBox="0 0 16 16"> <path d="M4 1.5H3a2 2 0 0 0-2 2V14a2 2 0 0 0 2 2h10a2 2 0 0 0 2-2V3.5a2 2 0 0 0-2-2h-1v1h1a1 1 0 0 1 1 1V14a1 1 0 0 1-1 1H3a1 1 0 0 1-1-1V3.5a1 1 0 0 1 1-1h1v-1z"/> <path d="M9.5 1a.5.5 0 0 1 .5.5v1a.5.5 0 0 1-.5.5h-3a.5.5 0 0 1-.5-.5v-1a.5.5 0 0 1 .5-.5h3zm-3-1A1.5 1.5 0 0 0 5 1.5v1A1.5 1.5 0 0 0 6.5 4h3A1.5 1.5 0 0 0 11 2.5v-1A1.5 1.5 0 0 0 9.5 0h-3z"/> </svg> </symbol> <symbol id="svg-copied" viewBox="0 0 16 16"> <title>Copied</title> <svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" fill="currentColor" class="bi bi-clipboard-check-fill" viewBox="0 0 16 16"> <path d="M6.5 0A1.5 1.5 0 0 0 5 1.5v1A1.5 1.5 0 0 0 6.5 4h3A1.5 1.5 0 0 0 11 2.5v-1A1.5 1.5 0 0 0 9.5 0h-3Zm3 1a.5.5 0 0 1 .5.5v1a.5.5 0 0 1-.5.5h-3a.5.5 0 0 1-.5-.5v-1a.5.5 0 0 1 .5-.5h3Z"/> <path d="M4 1.5H3a2 2 0 0 0-2 2V14a2 2 0 0 0 2 2h10a2 2 0 0 0 2-2V3.5a2 2 0 0 0-2-2h-1v1A2.5 2.5 0 0 1 9.5 5h-3A2.5 2.5 0 0 1 4 2.5v-1Zm6.854 7.354-3 3a.5.5 0 0 1-.708 0l-1.5-1.5a.5.5 0 0 1 .708-.708L7.5 10.793l2.646-2.647a.5.5 0 0 1 .708.708Z"/> </svg> </symbol> </svg> <div class="side-bar"> <div class="site-header" role="banner"> <a href="/htb-writeups/" class="site-title lh-tight"> <div class="site-logo" role="img" aria-label="HTB Writeups"></div> </a> <button id="menu-button" class="site-button btn-reset" aria-label="Toggle menu" aria-pressed="false"> <svg viewBox="0 0 24 24" class="icon" aria-hidden="true"><use xlink:href="#svg-menu"></use></svg> </button> </div> <nav aria-label="Main" id="site-nav" class="site-nav"> <ul class="nav-list"><li class="nav-list-item"><a href="/htb-writeups/" class="nav-list-link">Home</a></li><li class="nav-list-item"><button class="nav-list-expander btn-reset" aria-label="toggle items in Machines category" aria-pressed="false"> <svg viewBox="0 0 24 24" aria-hidden="true"><use xlink:href="#svg-arrow-right"></use></svg> </button><a href="/htb-writeups/machines/" class="nav-list-link">Machines</a><ul class="nav-list"><li class="nav-list-item"><a href="/htb-writeups/machines/easy/" class="nav-list-link">Easy Machines</a></li><li class="nav-list-item"><a href="/htb-writeups/machines/medium/" class="nav-list-link">Medium Machines</a></li><li class="nav-list-item"><a href="/htb-writeups/machines/hard/" class="nav-list-link">Hard Machines</a></li><li class="nav-list-item"><button class="nav-list-expander btn-reset" aria-label="toggle items in Insane Machines category" aria-pressed="false"> <svg viewBox="0 0 24 24" aria-hidden="true"><use xlink:href="#svg-arrow-right"></use></svg> </button><a href="/htb-writeups/machines/insane/" class="nav-list-link">Insane Machines</a><ul class="nav-list"><li class="nav-list-item"><a href="/htb-writeups/machines/insane/sink/" class="nav-list-link">Sink</a></li></ul></li></ul></li><li class="nav-list-item"><a href="/htb-writeups/prolabs/" class="nav-list-link">ProLabs</a></li><li class="nav-list-item"><a href="/htb-writeups/sherlocks/" class="nav-list-link">Sherlocks</a></li><li class="nav-list-item"><a href="/htb-writeups/ctf-events/" class="nav-list-link">CTF Events</a></li><li class="nav-list-item"><a href="/htb-writeups/endgames/" class="nav-list-link">Endgames</a></li><li class="nav-list-item"><a href="/htb-writeups/fortresses/" class="nav-list-link">Fortresses</a></li><li class="nav-list-item"><a href="/htb-writeups/attack-paths/" class="nav-list-link">Attack Paths</a></li><li class="nav-list-item"><button class="nav-list-expander btn-reset" aria-label="toggle items in Resources category" aria-pressed="false"> <svg viewBox="0 0 24 24" aria-hidden="true"><use xlink:href="#svg-arrow-right"></use></svg> </button><a href="/htb-writeups/resources/" class="nav-list-link">Resources</a><ul class="nav-list"><li class="nav-list-item"><button class="nav-list-expander btn-reset" aria-label="toggle items in Cheatsheets category" aria-pressed="false"> <svg viewBox="0 0 24 24" aria-hidden="true"><use xlink:href="#svg-arrow-right"></use></svg> </button><a href="/htb-writeups/resources/cheatsheets/" class="nav-list-link">Cheatsheets</a><ul class="nav-list"><li class="nav-list-item"><a href="/htb-writeups/resources/cheatsheets/active-directory/" class="nav-list-link">Active Directory</a></li><li class="nav-list-item"><a href="/htb-writeups/resources/cheatsheets/web-application/" class="nav-list-link">Web Application</a></li><li class="nav-list-item"><a href="/htb-writeups/resources/cheatsheets/privesc-linux/" class="nav-list-link">Linux Privesc</a></li><li class="nav-list-item"><a href="/htb-writeups/resources/cheatsheets/privesc-windows/" class="nav-list-link">Windows Privesc</a></li><li class="nav-list-item"><a href="/htb-writeups/resources/cheatsheets/reverse-shells/" class="nav-list-link">Reverse Shells</a></li><li class="nav-list-item"><a href="/htb-writeups/resources/cheatsheets/file-transfers/" class="nav-list-link">File Transfers</a></li><li class="nav-list-item"><a href="/htb-writeups/resources/cheatsheets/pivoting/" class="nav-list-link">Pivoting</a></li><li class="nav-list-item"><a href="/htb-writeups/resources/cheatsheets/password-attacks/" class="nav-list-link">Password Attacks</a></li><li class="nav-list-item"><a href="/htb-writeups/resources/cheatsheets/linux-enumeration/" class="nav-list-link">Linux Enumeration</a></li><li class="nav-list-item"><a href="/htb-writeups/resources/cheatsheets/windows-enumeration/" class="nav-list-link">Windows Enumeration</a></li></ul></li><li class="nav-list-item"><button class="nav-list-expander btn-reset" aria-label="toggle items in Methodology category" aria-pressed="false"> <svg viewBox="0 0 24 24" aria-hidden="true"><use xlink:href="#svg-arrow-right"></use></svg> </button><a href="/htb-writeups/resources/methodology/" class="nav-list-link">Methodology</a><ul class="nav-list"><li class="nav-list-item"><a href="/htb-writeups/resources/methodology/machine-approach/" class="nav-list-link">Machine Approach</a></li><li class="nav-list-item"><a href="/htb-writeups/resources/methodology/note-taking/" class="nav-list-link">Note Taking</a></li><li class="nav-list-item"><a href="/htb-writeups/resources/methodology/report-writing/" class="nav-list-link">Report Writing</a></li></ul></li><li class="nav-list-item"><a href="/htb-writeups/resources/cert-prep/" class="nav-list-link">Cert Prep</a></li></ul></li><li class="nav-list-item"><a href="/htb-writeups/skill-trees/" class="nav-list-link">Skill Trees</a></li><li class="nav-list-item"><a href="/htb-writeups/graph/" class="nav-list-link">Knowledge Graph</a></li><li class="nav-list-item"><a href="/htb-writeups/finder/" class="nav-list-link">Machine Finder</a></li></ul> </nav> <footer class="site-footer"> This site uses <a href="https://github.com/just-the-docs/just-the-docs">Just the Docs</a>, a documentation theme for Jekyll. </footer> </div> <div class="main" id="top"> <div id="main-header" class="main-header"> <div class="search" role="search"> <div class="search-input-wrap"> <input type="text" id="search-input" class="search-input" tabindex="0" placeholder="Search HTB Writeups" aria-label="Search HTB Writeups" autocomplete="off"> <label for="search-input" class="search-label"><svg viewBox="0 0 24 24" class="search-icon"><use xlink:href="#svg-search"></use></svg></label> </div> <div id="search-results" class="search-results"></div> </div> <nav aria-label="Auxiliary" class="aux-nav"> <ul class="aux-nav-list"> <li class="aux-nav-list-item"> <a href="https://github.com/momenbasel/htb-writeups" class="site-button" target="_blank" rel="noopener noreferrer" > GitHub </a> </li> <li class="aux-nav-list-item"> <a href="https://momenbasel.github.io/htb-writeups/finder/" class="site-button" target="_blank" rel="noopener noreferrer" > Machine Finder </a> </li> <li class="aux-nav-list-item"> <a href="https://momenbasel.github.io/htb-writeups/graph/" class="site-button" target="_blank" rel="noopener noreferrer" > Knowledge Graph </a> </li> </ul> </nav> </div> <div class="main-content-wrap"> <div id="main-content" class="main-content"> <main> <h.site-nav ul li a { background-image: linear-gradient(-90deg, rgb(31.6333333333, 30.8222222222, 34.8777777778) 0%, rgba(31.6333333333, 30.8222222222, 34.8777777778, 0.8) 80%, rgba(31.6333333333, 30.8222222222, 34.8777777778, 0) 100%); } </main> <hr> <footer> <p><a href="#top" id="back-to-top">Back to top</a></p> <p class="text-small text-grey-dk-100 mb-0">Copyright &copy; 2026 <a href="https://github.com/momenbasel">Moamen Basel</a>. Distributed under the <a href="https://github.com/momenbasel/htb-writeups/blob/main/LICENSE">MIT License</a>.</p> </footer> </div> </div> <div class="search-overlay"></div> </div> <script type="module"> import mermaid from 'https://cdn.jsdelivr.net/npm/mermaid@10.9.0/dist/mermaid.esm.min.mjs'; var config = {} ; mermaid.initialize(config); mermaid.run({ querySelector: '.language-mermaid', }); </script> </body> </html>
