Layover HTB
An assumed-breach style box that starts with valid credentials instead of a blind scan. A jump host with access to more than one network turns into the way in, and the path from there runs through an airport captive portal, a CMS admin panel, and an application that encrypts its own secrets. Root comes down to a known local service vulnerability once you're far enough in. Layover (layover.htb) is a medium Linux machine played as an assumed breach: you start with valid credentials instead of a blind scan, which makes it much closer to a real internal engagement than most boxes. The scenario is an airport network. A jump host that touches more than one network is the way in, and the path runs across segmented networks, a guest-facing captive portal, a content management system and an application that stores its own secrets encrypted. It is a box about pivoting and patience as much as exploitation. Skills practiced: SSH and RDP access, working inside WSL, network sniffing with tshark, pivoting and tunnelling with Ligolo-ng, web content discovery with Feroxbuster, CMS administration abuse, recovering application secrets, and Linux privilege escalation through a vulnerable local service. The full step-by-step walkthrough unlocks on this page as soon as the machine retires. This writeup is currently locked because the machine is still active on the Hack The Box platform. As per HTB policy, public writeups for active machines are not allowed. To avoid policy violations and potential account restrictions, this writeup will remain locked until the machine is retired. Once retired, the full writeup will be automatically unlocked and made available.
Difficulty: Medium · OS: linux · Category: HTB