CTF Writeups

Exploiting default credentials on a Zabbix ticketing system to gain initial access, then leveraging a KeePass memory dump to extract the master password and pivot to root.

Pre-authentication RCE in Metabase via a SSTI vulnerability in the setup token endpoint. Privilege escalation through a vulnerable Docker host environment variable.

WebSocket SQL injection to extract credentials, followed by abusing a PyInstaller build script running as sudo for privilege escalation.

Second-order SQL injection in a Laravel application to leak admin hashes, then exploiting ImageMagick MSL file to read arbitrary files and escalate to root via a Git hook.

Complex Active Directory attack chain involving AS-REP roasting, Kerberoasting, shadow credentials, cross-session relay, and RBCD for domain compromise.

Web challenge requiring enumeration of a Rick and Morty themed server, exploiting a command injection panel to read ingredient files.

Exploiting the EternalBlue (MS17-010) vulnerability using Metasploit against a Windows 7 target to achieve SYSTEM-level access.

Enumerating an exposed SMB share to find credentials, then using PrintSpoofer to escalate from low-privileged IIS service account to SYSTEM.

Classic stack buffer overflow to overwrite the return address and redirect execution to a win function that prints the flag.

Multi-round SQL injection challenge where each round filters different keywords. Requires creative bypass techniques to extract the admin password.

Reverse engineering a stripped binary to reconstruct the flag generation algorithm, involving anti-debugging techniques and obfuscated control flow.

Series of RSA challenges covering basic concepts: computing private exponents, factoring small moduli, and exploiting small public exponents.

Analyzing a disk image to find a hidden flag. Requires understanding of filesystem structures, file carving, and examining slack space.

Enumerating a gRPC service to discover a SQL injection vulnerability in the proto interface, then escalating via a vulnerable pyLoad instance.

Classic beginner VM exploiting an outdated Samba version with OpenFuck to gain root access. Great introduction to Metasploit and manual exploitation.

OSINT challenge involving researching a fictional person across social media platforms, GitHub, and public records to piece together hidden information.

Exploiting a SSTI vulnerability in a PGP verification page running inside a Firejail sandbox, then escaping the sandbox via a Firejail privilege escalation.

Using Sleuthkit tools to analyze a disk image, mounting partitions, and extracting a hidden flag from a Linux filesystem.

Return-to-libc attack against a 32-bit binary with stack canaries disabled. Chain libc gadgets to call system('/bin/sh') and pop a shell.

Exploiting a vm2 sandbox escape in a Node.js code execution environment, then cracking a bcrypt hash and exploiting a weak bash comparison in a backup script.

Steganography challenge hiding a flag within a PNG image using LSB encoding. Solved with Stegsolve and custom Python extraction script.

Exploiting a Drupal 7 installation vulnerable to Drupalgeddon2 (SA-CORE-2018-002) for RCE, then escalating privileges via SUID find binary.