HackTheBox Writeup - "MonitorsFour"

Mon, 04 May 2026 00:00:00 +0000

This assessment followed a black-box approach, beginning with active reconaissance, progressing through enumeration, initial unprivileged foothold into the authorized target, and finally privilege escalation. MonitorsFour is a HackTheBox “easy Windows” challenge.

Reconnaissance

Port and service scanning was performed on the target using nmap. It revealed an HTTP (insecure) webserver and a Microsoft HTTPAPI server, confirming the fact that this IP is associated with a Microsoft machine.

80/tcp open http nginx
|_http-title: Did not follow redirect to http://monitorsfour.htb/
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Enumeration on files and pages from the root directory of the resolved domain name (monitorsfour.htb) revealed information like a login and user path:

HackTheBox Writeup - "Pterodactyl"

Fri, 03 Apr 2026 00:00:00 +0000

Pterodactyl is a medium difficulty Linux HackTheBox machine: https://app.hackthebox.com/machines/Pterodactyl?sort_by=created_at&sort_type=desc

Reconnaissance

I ran a standard nmap service scan:

Not shown: 986 filtered tcp ports (no-response), 10 filtered tcp ports (admin-prohibited)
PORT STATE SERVICE VERSION 
22/tcp open ssh OpenSSH 9.6 (protocol 2.0) 
80/tcp open http nginx 1.21.5 
443/tcp closed https 
8080/tcp closed http-proxy

I navigated to the web server, which had an unresolvable domain name: pterodactyl.htb. I added the IP to my hosts to resolve it in my browser:

Php on Mike's Logs

HackTheBox Writeup - "MonitorsFour"

Reconnaissance

HackTheBox Writeup - "Pterodactyl"

Reconnaissance