CVE disclosures, AI red-teaming, and CTF writeups — published as they clear validation.
The HackTheBox Topology machine is an easy-rated Linux box that chains together classic web enumeration, a LaTeX injection vulnerability, credential cracking with John the Ripper, and a gnuplot + cron privilege escalation path.
GreenHorn is an easy-rated Linux box on HackTheBox. This writeup covers Pluck CMS 4.7.18 RCE via Gitea credential leakage, lateral movement through password reuse, and root privilege escalation by depixelizing a blurred PDF password.
Windows machine walkthrough: SMB share enumeration, VHD file mounting for SAM credential extraction, and privilege escalation via mRemoteNG password decryption.
Exploiting the Heartbleed vulnerability (CVE-2014-0160) to leak SSH credentials from memory, then escalating to root by hijacking an active tmux session.
Joomla CMS exploitation for initial access through admin panel takeover, followed by Linux privilege escalation via curl configuration file abuse.
Elastix PBX exploitation via local file inclusion to extract credentials, then multiple paths to root including Nmap interactive mode abuse.
Exploiting the UnrealIRCd 3.2.8.1 backdoor for initial shell access, then escalating to root through a custom SUID binary on Linux.
Active Directory machine: password spraying for initial foothold, LDAP enumeration, and domain admin access through SeBackupPrivilege token abuse.
DNS enumeration reveals a hidden banking application. File upload restriction bypass for webshell access, then root via writable SUID binary.
Nibbleblog CMS arbitrary file upload vulnerability for initial shell, then root access through sudo misconfiguration on Linux.
Joomla information disclosure (CVE-2023-23752) leaking database credentials, then privilege escalation to root via apport-cli on Linux.
IIS file upload bypass via web.config for initial shell on Windows, then SYSTEM access using the Chimichurri (MS10-059) kernel exploit.
Minecraft server enumeration, Java JAR plugin decompilation revealing hardcoded database credentials, and trivial root access via sudo su.
Request Tracker default credentials for initial access, then KeePass crash dump memory analysis (CVE-2023-32784) to extract the root SSH key.
Exploiting the PHP 8.1.0-dev supply chain backdoor via User-Agentt header for RCE, then root through knife binary sudo privilege on Linux.
Apache ActiveMQ CVE-2023-46604 deserialization RCE for initial shell, then root via nginx sudo misconfiguration allowing config overwrite.
Discovering phpbash webshell on Apache, lateral movement to scriptmanager user, then root access by abusing a Python cron job on Linux.
Raspberry Pi default credentials on a Pi-hole device for initial access, then recovering the deleted root flag from a USB drive using Linux forensics.
Shellshock (CVE-2014-6271) exploitation through CGI-bin scripts for remote command execution, then root via Perl sudo privilege escalation.
Directory bruteforcing pfSense firewall to discover admin credentials, then exploiting CVE-2014-4688 for remote command execution as root.
Adobe ColdFusion 8 directory traversal and file upload for RCE, then SYSTEM access via JuicyPotato on Windows Server 2008.
Abusing a printer admin panel to intercept LDAP credentials via netcat listener, then escalating privileges through Windows service configuration hijacking.