https://sh1nn.is-a.dev/tags/linux/Recent content in Linux on Sh1nn's blog - Penetration Tester and Security ResearcherHugoen-usSat, 21 Feb 2026 00:00:00 +0000https://sh1nn.is-a.dev/posts/2million/Sat, 21 Feb 2026 00:00:00 +0000https://sh1nn.is-a.dev/posts/2million/<h1 id="hack-the-box-twomillion-writeup">Hack The Box: TwoMillion Writeup</h1> <blockquote> <p><strong>Machine:</strong> TwoMillion<br> <strong>Operating system:</strong> Linux<br> <strong>Difficulty:</strong> Easy<br> <strong>Main techniques:</strong> JavaScript deobfuscation, API enumeration, broken authorization, OS command injection, credential reuse, and Linux kernel privilege escalation.</p> </blockquote> <blockquote> <p><strong>Legal notice:</strong> This writeup applies only to the retired Hack The Box machine and systems where testing is explicitly authorized.</p> </blockquote> <h2 id="overview">Overview</h2> <p>TwoMillion recreates an older version of the Hack The Box platform. The attack begins by reversing the invite-code workflow, continues through an authenticated API authorization flaw, and ends with a Linux kernel exploit.</p>