A personal reflection on reaching Platinum in Hack The Box Season 11, balancing the weekly challenge with work, family, and life as a new parent, and choosing a more sustainable pace for the journey ahead.
DanglingTree has been pwned and the complete writeup is ready. Publication is withheld while the machine remains active and will follow after official retirement, in accordance with Hack The Box's content policy.
Cohort has been pwned and the complete writeup is ready. Publication is withheld while the machine remains active and will follow after official retirement, in accordance with Hack The Box's content policy.
Bedside has been pwned and the complete writeup is ready. Publication is withheld while the machine remains active and will follow after official retirement, in accordance with Hack The Box's content policy.
Paperwork has been pwned and the complete writeup is ready. Publication is withheld while the machine remains active and will follow after official retirement, in accordance with Hack The Box's content policy.
Enigma has been pwned and the complete writeup is ready. Publication is withheld while the machine remains active and will follow after official retirement, in accordance with Hack The Box's content policy.
Nimbus has been pwned and the complete writeup is ready. Publication is withheld while the machine remains active and will follow after official retirement, in accordance with Hack The Box's content policy.
Checkpoint has been pwned and the complete writeup is ready. Publication is withheld while the machine remains active and will follow after official retirement, in accordance with Hack The Box's content policy.
Connected has been pwned and the complete writeup is ready. Publication is withheld while the machine remains active and will follow after official retirement, in accordance with Hack The Box's content policy.
A medium-difficulty box chaining an unauthenticated MCPJam Inspector RCE (CVE-2026-23744) for initial access, a Jupyter token leaked in process arguments to pivot to the analyst user, and a hidden MCP service config (hardcoded API key + a credential-dumping admin function) to recover root's SSH private key.