Home on Sh1nn's blog - Penetration Tester and Security Researcher

HTB TwoMillion Walkthrough

Sat, 21 Feb 2026 00:00:00 +0000

Hack The Box: TwoMillion Writeup

Machine: TwoMillion
Operating system: Linux
Difficulty: Easy
Main techniques: JavaScript deobfuscation, API enumeration, broken authorization, OS command injection, credential reuse, and Linux kernel privilege escalation.

Legal notice: This writeup applies only to the retired Hack The Box machine and systems where testing is explicitly authorized.

Overview

TwoMillion recreates an older version of the Hack The Box platform. The attack begins by reversing the invite-code workflow, continues through an authenticated API authorization flaw, and ends with a Linux kernel exploit.

Hello, World

Tue, 13 Jan 2026 00:00:00 +0000

Hey, welcome!

If you’ve somehow ended up here — hi. This is the very first post on this blog, so no writeup, no exploit chain, just a quick “who’s typing this” before we get into the fun stuff.

whoami

I’m sh1nn. I like breaking things (legally) — mostly penetration testing and security research. Somewhere between CTFs, bug bounty programs, and way too many browser tabs open at 2am trying to figure out why a payload isn’t firing.

About

Mon, 01 Jan 0001 00:00:00 +0000

Something about me!