skip to content
01 SITE A3 // SHAFT-07 · DESCENT ACTIVE

we don't find the door. we are already inside.

12 FILES RECOVERED HTB PROFESSIONAL · LVL 55 OSCP+ / OSCP / eJPT SEASON 11 · SILVER · #4824 155 SEASON POINTS · 6/26 FLAGS 2 RESEARCH PAPERS WE DON'T FIND THE DOOR. WE ARE ALREADY INSIDE.

RECOVERED FILES

EXCAVATION CATALOG →
№012 PG

Vault

Guest SMB write access exploited via malicious LNK file to capture NTLMv2 hash; cracked for WinRM foothold, then GenericWrite on Default Domain Policy abused with SharpGPOAbuse for admin.

HARD
№011 HTB

Editor

Exploiting XWiki (CVE-2025-24893) for RCE and privilege escalation via SUID abuse on ndsudo (CVE-2024-32019).

EASY
№010 PG

Resourced

Credentials leaked in LDAP description field give access to ntds.dit backup; hashes dumped for WinRM foothold, then RBCD attack via GenericWrite on DC for SYSTEM.

MEDIUM

LATEST RESEARCH

research →
№002 RESEARCH

React2Shell (CVE-2025-55182)

Complete technical analysis of CVE-2025-55182 (React2Shell): insecure deserialization in the RSC Flight protocol of React 19 enabling pre-auth RCE with CVSS 10.0.
// FIELD DISPATCHES

New recovered files, straight to your inbox. No noise.