https://0x5chltz.github.io/0x5chltzA minimal, responsive and feature-rich Jekyll theme for technical writing. 2026-01-05T12:44:01+07:00 Muhammad Sulthon Nurbahari https://0x5chltz.github.io/ Jekyll © 2026 Muhammad Sulthon Nurbahari /assets/img/favicons/favicon.ico /assets/img/favicons/favicon-96x96.png HacktraceRanges - Nightforge2025-10-24T00:00:00+07:00 2025-10-24T00:00:00+07:00 https://0x5chltz.github.io/posts/htr-nightforge/ Muhammad Sulthon Nurbahari Overview NightForge is a machine that runs Windows with an Easy difficulty level. Performed network port/service discovery on target 10.1.2.172 to identify exposed services (SSH, SMB, RPC/Print Spooler, etc.). Enumerated SMB shares as an unauthenticated/guest user and downloaded files from a publicly readable PUBLIC share for analysis. Found a printer maintainer credential encoded in base64; de... HackTheBox - Backfire2025-05-25T00:00:00+07:00 2025-05-25T00:00:00+07:00 https://0x5chltz.github.io/posts/htb-backfire/ Muhammad Sulthon Nurbahari Overview This engagement involved a comprehensive penetration test against target IP 10.10.11.49 to identify security vulnerabilities and potential privilege escalation paths within an infrastructure running multiple Command and Control (C2) frameworks. The testing focused on exploiting recently published vulnerabilities, analyzing insecure configurations, and demonstrating privilege escalatio... HackTheBox - Fluffy2025-05-25T00:00:00+07:00 2025-05-25T00:00:00+07:00 https://0x5chltz.github.io/posts/htb-fluffy/ Muhammad Sulthon Nurbahari Overview Fluffy is a Windows-based Active Directory environment that demonstrates the complete journey from limited access to full domain control through a series of interconnected vulnerability exploits. Starting with basic SMB credentials, I exploited unpatched CVE-2025-24071 to steal NTLM hashes, then compromised them through password spraying. BloodHound analysis uncovered a critical permi... HackTheBox - EscapeTwo2025-05-25T00:00:00+07:00 2026-01-03T23:57:15+07:00 https://0x5chltz.github.io/posts/htb-escapetwo/ Muhammad Sulthon Nurbahari Overview EscapeTwo is a Windows-based Active Directory environment demonstrating common security misconfigurations including credential exposure, insecure certificate template configurations, and privilege escalation vectors through DACL modification. The path to domain compromise involves MSSQL service account compromise, certificate template manipulation, and shadow credential attacks. Recon... HackTheBox - Heal2025-05-15T00:00:00+07:00 2025-05-19T13:45:43+07:00 https://0x5chltz.github.io/posts/htb-heal/ Muhammad Sulthon Nurbahari Overview Heal is a machine that runs Linux with a Medium difficulty level. Demonstrates a multi-layered attack surface involving web application vulnerabilities, credential reuse, and privilege escalation via exposed services. The engagement began with subdomain enumeration and culminated in full root access through a chain of exploits targeting Ruby on Rails, LimeSurvey, and HashiCorp Consul. ...