> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/writeups-ctf/hackthebox.md). # HackTheBox 按 Linux 和 Windows 难度分类整理的 HackTheBox 主机 writeup，涵盖枚举、初始立足点、权限提升、Active Directory、Web 利用以及服务滥用。 按操作系统和难度整理的 HackTheBox 靶机 writeup。 ## HTB 方法论 1. 枚举暴露的服务、Web 应用、子域、共享以及认证面。 2. 通过凭据、CVE、文件上传、LFI、命令注入或服务滥用找到初始立足点。 3. 稳定访问并收集本地上下文：用户、配置、凭据、计划任务、服务和内部端口。 4. 通过 Linux 配置错误、Windows 权限滥用、Active Directory 路径或存在漏洞的服务提升权限。 ## 靶机分类

:linux:

Linux 简单

涵盖 Web 枚举、暴露服务、凭据发现、文件泄露、CMS 利用和 Linux 权限提升的 HackTheBox Linux 简单靶机 writeup。HTB Linux 简单

:windows:

Windows 简单

涵盖 SMB、Active Directory 枚举、WinRM、文件泄露、服务滥用、凭据攻击和 Windows 权限提升的 HackTheBox Windows 简单靶机 writeup。HTB Windows 简单

:linux:

Linux 中等

涵盖 Web 利用、SQL 注入、SSRF、CMS RCE、凭据、横向移动和 Linux 权限提升的 HackTheBox Linux 中等靶机 writeup。HTB Linux 中等

:windows:

Windows 中等

涵盖文件包含、WebShell、Jenkins、Active Directory、Windows 权限提升和后渗透的 HackTheBox Windows 中等靶机 writeup。HTB Windows 中等难度
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/zh/writeups-ctf/hackthebox.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.