> ## Documentation Index
> Fetch the complete documentation index at: https://rootea.es/llms.txt
> Use this file to discover all available pages before exploring further.
# Anubis
> Verified writeups for the Anubis machine of Hack The Box
# Anubis
\$ tldr ASP SSTI → Chisel pivot → Software Portal abuse → AD
| · | · |
| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Operating system | Windows |
| Difficulty | Insane |
| Vector | Web |
| IP | `10.10.11.102` |
| Retirement date | 2022-01-29 |
| Skills | SSL Certificate Inspection - OpenSSL XSS (Cross-Site Scripting) ASP SSTI (Server Side Template Injection) (HackingDream ASP Resource) \[RCE] InvokePowerShellTcp.ps1 - PowerShell Reverse Shell ConPtyShell (AntonioCoco Utility) - Shell Improvement Certificate Signing Request Inspection - OpenSSL Chisel + Remote Port Forwarding + Proxychains - Creating a SOCKS5 tunnel Abusing Software Portal Traffic inspection with Tcpdump and Tshark URL Host Manipulation Attack + Intercepting authentications with Netcat Playing with Responder to get a Net-NTLMv2 hash Cracking Hashes SMB enumeration with authenticated user Jamovi \<=1.6.18 Exploitation - Malicious OMV File (XSS Vulnerability - Cross-Site Scripting Attack) XSS + NodeJS Command Injection + InvokePowerShellTcp.ps1 (Nishang) Reverse Shell ConPtyShell (AntonioCoco Utility) - Shell Improvement Abusing Certificate Services Playing with Certify.exe to find vulnerable templates PowerView\.ps1 + ADCS.ps1 in order to generate a certificate request and get it approved by the CA ADCS.ps1 script manipulation (userprincipalname/samaccountname \[Substitution Applied]) Listing certificates with gci command Attempting to obtain credentials with Rubeus (asktgt mode) \[ERROR - No longer working] Exploiting CVE-2021-42278/CVE-2021-42287 (noPac.py) through Proxychains \[Alternative Exploitation] Synchronizing our time with DC time (rdate) - Headers Information Leakage Getting an interactive console as the administrator user on the DC (noPac.py) |
## Writeups
| Language | Author | Format | Link |
| -------- | ------------------------ | ------ | --------------------------------------------------------- |
| 🇪🇸 ES | **S4vitar** | Vídeo | [Open](https://www.youtube.com/watch?v=oFBSn4iaLUo) |
| 🇪🇸 ES | **El Pingüino de Mario** | Vídeo | [Open](https://www.youtube.com/watch?v=wDJWJx0hBrI) |
| 🇬🇧 EN | **0xdf** | Texto | [Open](https://0xdf.gitlab.io/2022/01/29/htb-anubis.html) |
| 🇬🇧 EN | **IppSec** | Vídeo | [Open](https://www.youtube.com/watch?v=tEwH1FeH1mw) |
## Skill resources
Curated documentation for each technique listed in the *Skills* column above. Sources: HackTricks, GTFOBins, PortSwigger, etc.
| Skill | Source | Link |
| ------------------------------------- | ----------- | --------------------------------------------------------------------------------------------- |
| SSTI (Server-Side Template Injection) | PortSwigger | [Open](https://portswigger.net/web-security/server-side-template-injection) |
| Cross-Site Scripting (XSS) | HackTricks | [Open](https://book.hacktricks.wiki/en/pentesting-web/xss-cross-site-scripting/index.html) |
| Cross-Site Scripting (XSS) | PortSwigger | [Open](https://portswigger.net/web-security/cross-site-scripting) |
| Information Leakage | HackTricks | [Open](https://book.hacktricks.wiki/en/pentesting-web/information-leak.html) |
| OS Command Injection | PortSwigger | [Open](https://portswigger.net/web-security/os-command-injection) |
| Cracking Hashes (hashcat / John) | HackTricks | [Open](https://book.hacktricks.wiki/en/generic-methodologies-and-resources/brute-force.html) |
| Port Forwarding / Pivoting | HackTricks | [Open](https://book.hacktricks.wiki/en/generic-hacking/tunneling-and-port-forwarding.html) |
| SMB (139/445) | HackTricks | [Open](https://book.hacktricks.wiki/en/network-services-pentesting/pentesting-smb/index.html) |
| Remote Code Execution (RCE) | HackTricks | [Open](https://book.hacktricks.wiki/en/pentesting-web/command-injection.html) |
## Related skills worth mastering
SQL Injection · Server-Side Request Forgery · Brute Force / Rate-Limit Bypass · EternalBlue (MS17-010) · MS08-067 (NetAPI) · Local File Inclusion (LFI) · Remote File Inclusion (RFI) · Shellshock (CVE-2014-6271)
## If you liked this machine, try
* [Nightmare](/en/htb/machines/linux/insano/nightmare) — Linux, Insane
* [Sniper](/en/htb/machines/windows/medio/sniper) — Windows, Medium
* [Unbalanced](/en/htb/machines/linux/dificil/unbalanced) — Linux, Hard
* [CrossFit](/en/htb/machines/linux/insano/crossfit) — Linux, Insane
* [Acute](/en/htb/machines/windows/dificil/acute) — Windows, Hard
***
## Comments & tips
Did the official writeup not work? Found a smarter trick? Share it here — comments live in [GitHub Discussions](https://github.com/FFuson/HTB_Writeups/discussions).
*Last updated: 2026-07-27*