Control

Verified writeups for the Control machine of Hack The Box

Control

$ tldr SQLi a RCE (INTO OUTFILE) → ConPtyShell → ImagePath hijacking

·	·
Operating system	Windows
Difficulty	Hard
Vector	Web
IP	10.10.11.167
Retirement date	2020-04-25
Skills	SQL Injection [SQLI] - Error Based Advanced Bash Scripting (EXTRA) SQLI to RCE (Into Outfile - PHP File Creation) ConPtyShell (Fully Interactive Reverse Shell for Windows) Playing with ScriptBlocks and PSCredential to execute commands as another user AppLocker Bypass WinPEAS Enumeration Service ImagePath Hijacking (Privilege Escalation)

Writeups

Language	Author	Format	Link
🇪🇸 ES	S4vitar	Vídeo	Open
🇪🇸 ES	El Pingüino de Mario	Vídeo	Open
🇬🇧 EN	0xdf	Texto	Open
🇬🇧 EN	IppSec	Vídeo	Open

Skill resources

Curated documentation for each technique listed in the Skills column above. Sources: HackTricks, GTFOBins, PortSwigger, etc.

Skill	Source	Link
SQL Injection	HackTricks	Open
SQL Injection	PortSwigger	Open
winPEAS	PEASS-ng	Open
Remote Code Execution (RCE)	HackTricks	Open

Related skills worth mastering

Cross-Site Scripting (XSS) · Active Directory · Local File Inclusion (LFI) · Remote File Inclusion (RFI) · Shellshock (CVE-2014-6271)

If you liked this machine, try

• Bastard — Windows, Medium
• Europa — Linux, Medium
• Fighter — Windows, Insane
• Toolbox — Windows, Easy
• Flujab — Linux, Hard

---

Comments & tips

Did the official writeup not work? Found a smarter trick? Share it here — comments live in GitHub Discussions.

Last updated: 2026-06-07