https://blog.0xprashant.in/ Welcome to the official blog of Prashant Saini, also known as 0xprashant. This blog features cybersecurity write-ups from Hack The Box, RootME, and various CTFs, along with reviews of cybersecurity certifications to aid individuals in their growth and learning. 2024-11-20T20:29:47+05:30 Prashant Saini https://blog.0xprashant.in/ Jekyll © 2024 Prashant Saini /assets/img/favicons/favicon.ico /assets/img/favicons/favicon-96x96.png 2021-08-23T00:00:00+05:30 2024-10-05T22:06:52+05:30 https://blog.0xprashant.in/posts/oscp-review/ Prashant Saini

This blog contains my honest review and oponion on OSCP Exam organized by Offensive Security. I am going to discuss about my OSCP journey, it’s lab and exam review, The whole timeline from begining to end, The Resources i used/followed during the preparation

2021-04-13T00:00:00+05:30 2024-10-19T20:58:49+05:30 https://blog.0xprashant.in/posts/htb-lovetok/ Prashant Saini

We are given the source code for the website hosted , There is a feature that will tell you the time you will get your true love. That time is Evaluate with the help of a eval() function and the eval function is a vulnerable to Command Injection itself , Exploiting the Command injection to get the flag.

2020-11-17T00:00:00+05:30 2024-10-05T22:06:52+05:30 https://blog.0xprashant.in/posts/htb-laboratory/ Prashant Saini

The journey starts with a new VHOST that i got from the DNS of ssl certificate , Gitlab is hosted on the new vhost.The Current version of the gitlab-ce is vulnerable to LFI and RCE exploiting the RCE and getting initial shell in a docker , Resrting the admin account with github-rails console and login as him on gitlab.GOt the private ssh keys in a project-repo , Login as dexter and got a suid c...

2020-11-09T00:00:00+05:30 2024-10-05T22:06:52+05:30 https://blog.0xprashant.in/posts/htb-academy/ Prashant Saini

Altering the administrator username by changing the roleid and login as admin on the web , two ways to get user one is admin page revealing a new VHOST which is running on laravel , and the lavarel is exposing its app_key so its is vulnerable to RCE , Exploiting the RCE and get a shell as www-data . and second is reading the .env file and get the password for the user from academy dir , Hit an...

2020-10-25T00:00:00+05:30 2024-10-05T22:06:52+05:30 https://blog.0xprashant.in/posts/htb-time/ Prashant Saini

There are two features on webiste ONLINE JSON BEAUTIFIER & VALIDATOR the validator feature is vulnerable to a CVE and after searching about it bit more got initial shell as user , Privlege escaltion was bit easy there is a timer_backup script that is in cronjobs and running as root, and we have write permissions to it , writing our rev shell to it and got root