Ala Loghmari — security consultant and penetration tester in Tunis. Offensive security writeups across web apps, Active Directory, cloud and infrastructure.https://loghmariala.github.io/https://loghmariala.github.io/writeups/underpass/https://loghmariala.github.io/writeups/underpass/Underpass is an easy-rated HackTheBox machine that begins with discovering an open SNMP port revealing information about a web application, Daloradius. Using default credentials, we accessed the…Sat, 10 May 2025 00:00:00 GMTDaloradiusMoshhttps://loghmariala.github.io/writeups/administrator/https://loghmariala.github.io/writeups/administrator/Administrator, a Medium-rated Windows machine from HackTheBox, involved exploiting an Active Directory misconfiguration to gain initial access. We then brute-forced a Password Manager backup to…Sat, 19 Apr 2025 00:00:00 GMTActive DirectoryBloodHoundPassword SafeGenericAllForceChangePasswordGenericWriteSecretsDumphttps://loghmariala.github.io/writeups/yummy/https://loghmariala.github.io/writeups/yummy/Yummy is a hard-rated HackTheBox machine where we exploit a vulnerable web application to perform session hijacking, file disclosure, and SQL injection, gaining initial access. Once inside, we take…Sat, 22 Feb 2025 00:00:00 GMTPath TraversalSQLiJWTHGRsynchttps://loghmariala.github.io/writeups/cicada/https://loghmariala.github.io/writeups/cicada/Cicada is an easy HackTheBox machine which simulates an Active Directory environment where we first start by enumerating SMB shares and users available on the box finding a user credentials that…Sat, 15 Feb 2025 00:00:00 GMTActive DirectorySMBLDAPSeBackupPrivilegehttps://loghmariala.github.io/writeups/caption/https://loghmariala.github.io/writeups/caption/Caption is a HackTheBox hard machine where we discovered SSH, HTTP, and GitBucket services. We exploited a GitBucket vulnerability to gain access to the system and found a LogService flaw that…Sun, 26 Jan 2025 00:00:00 GMTGitBucketThriftRCEH2https://loghmariala.github.io/writeups/monitorsthree/https://loghmariala.github.io/writeups/monitorsthree/MonitorsThree is a Medium HackTheBox machine where we start by enumerating a web server finding an SQLi that leads to data leak for then gaining a reverse shell by exploiting a vulnerability in cacti…Sat, 18 Jan 2025 00:00:00 GMTSQLicactiCVE-2024-25641RCEDuplicatihttps://loghmariala.github.io/writeups/sightless/https://loghmariala.github.io/writeups/sightless/Sightless is a HackTheBox easy machine where we began by enumerating open ports, revealing FTP, SSH, and a web server. The web server hosted a SQLPad instance vulnerable to CVE-2022-0944, which we…Sat, 11 Jan 2025 00:00:00 GMTSQLPadCVE-2022-0944DockerChromeFroxlorhttps://loghmariala.github.io/writeups/sea/https://loghmariala.github.io/writeups/sea/Sea is a HackTheBox easy machine where we started by exploiting a vulnerability in WonderCMS gaining a reverse shell, from there a hash was found and we were able to retrieve its plain-text value…Sun, 22 Dec 2024 00:00:00 GMTCVE-2023-41425WonderCMSCommand Injectionhttps://loghmariala.github.io/writeups/greenhorn/https://loghmariala.github.io/writeups/greenhorn/GreenHorn is an easy machine by HackTheBox where we are dealing with a Pluck web application, digging around we find the source code of the web app from there we gain access to admin panel where we…Sat, 07 Dec 2024 00:00:00 GMTPluckReverse Pixelationhttps://loghmariala.github.io/writeups/whiterose/https://loghmariala.github.io/writeups/whiterose/Whiterose is a easy-rated TryHackMe machine where we first start by discovering a subdomain, using provided credentials we were able to log in into the web application, discovering an IDOR vulnerable…Fri, 01 Nov 2024 00:00:00 GMTIDORejsSudoeditSSTICVE-2022-29078CVE-2023-22809https://loghmariala.github.io/writeups/mountaineer/https://loghmariala.github.io/writeups/mountaineer/Mountaineer is a hard-rated TryHackMe machine that begins with discovering a WordPress site hosted on a vulnerable Nginx web server. The server is susceptible to Local File Inclusion (LFI) due to…Sun, 20 Oct 2024 00:00:00 GMTWordpressNginxLFIRoundcubeRCEKeePasshttps://loghmariala.github.io/writeups/editorial/https://loghmariala.github.io/writeups/editorial/Editorial is an easy machine by HackTheBox where We start by exploiting an SSRF vulnerability in a book cover upload feature, which reveals an internal open port. Using credentials leaked from an…Sat, 19 Oct 2024 00:00:00 GMTGitpythonCVE-2022-24439https://loghmariala.github.io/writeups/backtrack/https://loghmariala.github.io/writeups/backtrack/Backtrack is a medium-rated TryHackMe machine focused on Local File Inclusion (LFI). It begins with exploiting an Aria2 web app vulnerable to LFI, leading to a Tomcat credentials leak and gaining an…Sun, 13 Oct 2024 00:00:00 GMTLFIAria2CVE-2023-39141AnsibleTTY Pushbackhttps://loghmariala.github.io/writeups/blurry/https://loghmariala.github.io/writeups/blurry/Blurry is a medium box on HTB where we discovered a ClearML application. By exploiting CVE-2024-24590, that was affecting the ClearML web app, we gained a reverse shell. For privilege escalation, we…Sat, 12 Oct 2024 00:00:00 GMTClearMLCVE-2024-24590Machine LearningModelshttps://loghmariala.github.io/writeups/pyrat/https://loghmariala.github.io/writeups/pyrat/Pyrat is an easy-rated TryHackMe machine that simulates a running Python RAT on an open socket. The challenge involves leaking a GitHub account to gain access to the PyRat source code, which helps in…Wed, 02 Oct 2024 00:00:00 GMTPyrathttps://loghmariala.github.io/writeups/thelondonbridge/https://loghmariala.github.io/writeups/thelondonbridge/The London Bridge is a TryHackMe Medium machine where we first start by discovering an internal web server through SSRF, finding a .ssh folder that contains a private key, making it into the machine…Fri, 27 Sep 2024 00:00:00 GMTSSRFKernelCVE-2018-18955Mozillahttps://loghmariala.github.io/writeups/cheesectf/https://loghmariala.github.io/writeups/cheesectf/Cheese CTF is a TryHackMe easy machine where it starts finding an LFI vulnerability leading to RCE, escalate our privileges through a writable authorizedkeys for then to manipulate a .timer service…Wed, 25 Sep 2024 00:00:00 GMTRCELFISystemd Timershttps://loghmariala.github.io/writeups/breakme/https://loghmariala.github.io/writeups/breakme/Breakme is a Medium Tryhackme room where we start by exploiting an outdated wordpress plugin to gain higher privileges, gaining a reverse shell we found an internal web server that's vulnerable to…Mon, 23 Sep 2024 00:00:00 GMTWordpressCommand InjectionPort ForwardRace ConditionTOCTOUPython Jailhttps://loghmariala.github.io/writeups/hammer/https://loghmariala.github.io/writeups/hammer/Hammer is a medium rated room on TryHackMe. The room starts with a web server on an unusual port having a login page and a reset password feature, enumerating the web server we found an email that we…Sat, 31 Aug 2024 00:00:00 GMTRCEBruteforcePINJWThttps://loghmariala.github.io/writeups/uahighschool/https://loghmariala.github.io/writeups/uahighschool/U.A. High School is an easy Tryhackme box where we start by finding a GET parameter that allows us to execute code, once in the box, we found a corrupted image that contains a user creds for then to…Sat, 24 Aug 2024 00:00:00 GMTRCESteganographyCommand Injectionhttps://loghmariala.github.io/writeups/apiwizards/https://loghmariala.github.io/writeups/apiwizards/Sat, 03 Aug 2024 00:00:00 GMTDigital ForensicsIncident ResponseDFIRhttps://loghmariala.github.io/writeups/usage/https://loghmariala.github.io/writeups/usage/Usage is an easy HackTheBox machine where we discovered an SQL injection vulnerability on the web server, allowing us to extract the admin password hash. Cracking the hash enabled us to log in and…Wed, 31 Jul 2024 00:00:00 GMTSQLi7zWildcards Spare Trickshttps://loghmariala.github.io/writeups/iclean/https://loghmariala.github.io/writeups/iclean/IClean is a medium machine by HackTheBox. We start by exploiting an XSS vulnerability to steal the admin's session cookie. Using the cookie, we access the admin dashboard and find a SSTI…Wed, 24 Jul 2024 00:00:00 GMTXSSSSTIqpdfCookie Stealinghttps://loghmariala.github.io/writeups/boardlight/https://loghmariala.github.io/writeups/boardlight/BoardLight is an easy box on HackTheBox where we start by exploiting a vulnerability in the Dolibarr web application, using default credentials to gain access. We then pivot to a user account by…Tue, 23 Jul 2024 00:00:00 GMTDolibarrCVE-2022-37706CVE-2023-30253