> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/writeups-ctf/hackthebox.md).

# HackTheBox

按操作系统和难度整理的 HackTheBox 靶机 writeup。

## HTB 方法论

1. 枚举暴露的服务、Web 应用、子域、共享和认证入口。
2. 通过凭证、CVE、文件上传、LFI、命令注入或服务滥用获取初始立足点。
3. 稳定访问并收集本地环境信息：用户、配置、凭证、计划任务、服务和内部端口。
4. 通过 Linux 错误配置、Windows 权限滥用、Active Directory 路径或存在漏洞的服务进行提权。

## 靶机分类

<table data-view="cards" data-full-width="false" data-search="false"><thead><tr><th></th><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><h3><i class="fa-linux" style="color:$primary;">:linux:</i></h3></td><td><h4>Linux 简单</h4></td><td>涵盖 Web 枚举、暴露服务、凭证发现、文件泄露、CMS 利用和 Linux 提权的 HackTheBox Linux 简单靶机 writeup。</td><td><a href="/pages/f7b44579f27e02d44112d8cb5ab750f5fd62281b">/pages/f7b44579f27e02d44112d8cb5ab750f5fd62281b</a></td></tr><tr><td><h3><i class="fa-windows" style="color:$primary;">:windows:</i></h3></td><td><h4>Windows 简单</h4></td><td>涵盖 SMB、Active Directory 枚举、WinRM、文件泄露、服务滥用、凭证攻击和 Windows 提权的 HackTheBox Windows 简单靶机 writeup。</td><td><a href="/pages/0eb4260dfed9acbf07843546fda176dfa63781c2">/pages/0eb4260dfed9acbf07843546fda176dfa63781c2</a></td></tr><tr><td><h3><i class="fa-linux" style="color:$primary;">:linux:</i></h3></td><td><h4>Linux 中等</h4></td><td>涵盖 Web 利用、SQL 注入、SSRF、CMS RCE、凭证、内网穿透和 Linux 提权的 HackTheBox Linux 中等靶机 writeup。</td><td><a href="/pages/10a289813154c7536a4d77e092a46e29fd767435">/pages/10a289813154c7536a4d77e092a46e29fd767435</a></td></tr><tr><td><h3><i class="fa-windows" style="color:$primary;">:windows:</i></h3></td><td><h4>Windows 中等</h4></td><td>涵盖文件包含、Web Shell、Jenkins、Active Directory、Windows 提权和后渗透的 HackTheBox Windows 中等靶机 writeup。</td><td><a href="/pages/5c6d697559d49f56948edb27970c1d0f708819da">/pages/5c6d697559d49f56948edb27970c1d0f708819da</a></td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/writeups-ctf/hackthebox.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.