https://innocentx0.github.io/INNOCENTx0hacking,hackthebox writeup, walktrough,hacking methodologies 2026-11-08T10:23:30+00:00 Kevin Bateman https://innocentx0.github.io/ Jekyll © 2026 Kevin Bateman /assets/img/favicons/favicon.ico /assets/img/favicons/favicon-96x96.png Compromising a full AD environment (volume shadow copying and ntds.dit dumping)2026-11-01T16:00:00+00:00 2026-11-01T16:00:00+00:00 https://innocentx0.github.io/posts/baby-htb/ Kevin Bateman Baby - Writeup By innocentx0 Target: 10.129.234.71 , Domain: baby.vl , DC: BABYDC Recon Rustscan ❯ rustscan -a 10.129.234.71 --ulimit 5000 -g 10.129.234.71 -> [53,88,135,139,389,445,464,593,636,3268,3269,5985,49664,49668,61016,61022,62782,62794,61015] Nmap ❯ nmap -sT -A -Pn -T5 -p 53,88,135,139,389,445,464,593,636,3268,3269,5985,49664,49668,61016,61022,62782,62794,61015 10.129.234.71 ... From normal user to domain admin with exploiting Kerberos and ESC162026-11-01T16:00:00+00:00 2026-11-02T20:44:46+00:00 https://innocentx0.github.io/posts/fluffy-htb/ Kevin Bateman Fluffy - Writeup Target: 10.129.232.88 Domain: fluffy.htb DC: DC01 Recon As always, i start our target scan with rustscan rustscan -a 10.129.232.88 --ulimit 5000 Open ports: 53, 88, 139, 389, 445, 464, 593, 636, 9389, dynamic RPC. Just afterwards, i hand every discovered port to our friend nmap nmap -sT -A -Pn -T5 -p 53,88,139,389,445,464,593,636,9389,49668,49693,49694,49700,49713,49726,49... HTB SteamCloud Writeup: Zero Credentials to Root Inside a Kubernetes Cluster2026-10-23T16:00:00+00:00 2026-10-23T16:00:00+00:00 https://innocentx0.github.io/posts/steamcloud-htb/ Kevin Bateman Target 10.129.96.167 Network recon Rustscan rustscan -a 10.129.96.167 --ulimit 5000 -g 10.129.96.167 -> [22,2380,2379,10250,10256,10249] Nmap nmap -sT -A -Pn -T5 -p 22,2380,2379,10250,10256,10249 10.129.96.167 22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 2379/tcp open ssl/etcd-client? 2380/tcp open ssl/etcd-server? 10249/tcp open http Golang net... HTB Cohort Writeup: SSRF to Marimo RCE to Root2026-09-29T16:00:00+00:00 2026-10-11T10:13:09+00:00 https://innocentx0.github.io/posts/cohort-htb/ Kevin Bateman Target 10.129.22.194 Network recon Rustscan rustscan -a $ip --ulimit 5000 Open 10.129.22.194:22 Open 10.129.22.194:80 Nmap nmap -sT -A -Pn -T5 -p 22,80 10.129.22.194 --disable-arp-ping --min-rtt-timeout 50ms --max-rtt-timeout 100ms --stats-every=2s 22/tcp open ssh syn-ack 80/tcp open http syn-ack Just ssh and http. Nothing to brute force or play with on the ssh side yet, so... HTB Enigma Writeup: From an NFS Leak to Root via OliveTin2026-07-07T16:00:00+00:00 2026-07-07T16:00:00+00:00 https://innocentx0.github.io/posts/enigma-htb/ Kevin Bateman Target 10.129.26.76 Network recon Rustscan rustscan -a 10.129.26.76 --ulimit 5000 -g Open 10.129.26.76:22 Open 10.129.26.76:80 Open 10.129.26.76:110 Open 10.129.26.76:111 Open 10.129.26.76:143 Open 10.129.26.76:995 Open 10.129.26.76:993 Open 10.129.26.76:35373 Open 10.129.26.76:40535 Open 10.129.26.76:47293 Open 10.129.26.76:57917 Open 10.129.26.76:59239 10.129.26.76 -> [22,80,110,111...