Layover - HackTheBox

Approach

Enabling wireless network and host discovery

Capturing Credentials via Passive Sniffing

Craft CMS RCE (Behavior Injection)

Database Secrets and Password Decryption

CUPS Local Root (CVE-2026-34990)

Full writeup is restricted while this machine is active.

The writeup will be published here once the machine is retired.