<Tag: ctf />

A hunt through a resort's offline WMI repository that traces a fileless backdoor from a "clean" event-log binding down through Base64-and-UTF16-encoded PowerShell, a reflectively-loaded .NET payload hidden in a custom Win32_HardwareTelemetry class, and a quietly planted net user backdoor account.

MartiniAD is an Easy-difficulty Active Directory lab hosted by HackSmarter. The domain `DRY.MARTINI.BARS` is fronted by a single Domain Controller (`DC01`) that permits unauthenticated SMB null/guest sessions. This allows enumeration of a non-default share containing plaintext credentials for a low-privileged domain user. Those credentials are used to Kerberoast a service account, whose cracked password grants a foothold via WinRM. Password reuse between the service account and a linked human Tier-0 admin account (which sits in Domain Admins) then provides full domain compromise, culminating in a DCSync attack to extract the KRBTGT hash.

Compromising the ShadowGate Active Directory lab through a chained attack path — from AS-REP roasting and ACL abuse via Shadow Credentials, to coercing the Domain Controller with PetitPotam and relaying its authentication into a certificate-based DCSync — culminating in full domain compromise via the krbtgt hash.

In this HackSmarter SysAdmins lab, I chained anonymous FTP disclosure, OSINT, SNMPv3 username and credential reuse, and a critical sudo privilege escalation (CVE-2025-32463) to move from initial access to full root compromise.

This is a Medium AWS Challenge Lab, it is an IAM privilege escalation via access key rotation abuse.

Exploit a standard implementation of the Hidden Field Equations protocol via Groebner Basis

Predictable hash function that results in breaking the decisional problem by enumerating all group elements.

Recover RSA private key given leaked information from PEM file using Coppersmith's small roots

Connect to PRET PJL mode, enumerate device files, recover the latest journal receipt, follow the NVRAM reference, and read NVRAM to recover the flag.

This writeup demonstrates how to bypass a banking AI's security guardrails by chaining context manipulation and audit pretexting to ultimately extract hidden API keys through a subtle "Leakage in Refusal" vulnerability.

This writeup details how to drain an ERC-4626-style vault in HTB's "Caldrin's Day Away" challenge by leveraging a massive flash loan to manipulate an AMM reserve, feeding the poisoned data through a flawed oracle to artificially inflate the vault's share price.

In this medium-difficulty Cloud challenge, you must trace the origins and financial backing of a malicious rumor to stop a framed Stormbound captain from being wrongfully stripped of their crucial guard post.

Cadence in the Cord is a Sigrok/UART challenge where the apparent serial message only serves as a guide to a second, covert channel encoded in the inter-frame timing—short gaps as 0, long gaps as 1.

Line Tap demonstrates how a forgotten Telnet maintenance interface on an ICS host can be turned into instant, unauthenticated root via CVE-2026-24061 by abusing the NEW-ENVIRON USER=-f root trick, making the challenge a clean lesson in legacy service risk, argument injection, and critical exposure in operational technology environments.

Corroded Crown from the Cyber Apocalypse 2026 CTF was an easy Pwn challenge vulnerable to a classic Use-After-Free (UAF) due to un-cleared dangling pointers and missing state validation. By leveraging an unsorted bin leak to bypass ASLR and poisoning the unencrypted GLIBC 2.31 tcache bins, we successfully redirected __free_hook to system(). Triggering a final memory cleanup operation immediately spawned an interactive shell to capture the flag.

Heavy Is The Krown is a hard Linux kernel exploitation challenge from HTB Cyber Apocalypse 2026 that revolves around a kmalloc-512 Use-After-Free in a custom `/dev/krown` driver, letting an attacker hijack slab objects shared by “lord” and “vassal” structures. By overlaying a freed vassal with procfs `seq_file` data to defeat KASLR and then abusing the dangling pointer to overwrite `modprobe_path`, the exploit script gains root execution via a crafted helper script and extracts the flag.

The Emptiness Machine is a modern FSOP-based pwn challenge from Hack The Box’s Cyber Apocalypse 2026 that demonstrates how glibc file stream structures in a fully mitigated Linux x86_64 environment can still be abused for powerful exploitation. By combining a controlled leak from stdout to defeat ASLR with a carefully aligned House of Apple 2 attack on stderr, the solver script reliably turns program teardown (_IO_flush_all()) into a remote shell and captures the flag.

Words from the Past is a x86_64 Linux pwn challenge centered around constrained 5-byte micro-shellcode execution across a two-stage state machine. The binary implements multiple layers of anti-analysis and anti-debugging protections, including timing anomaly detection (rdtsc), library preloading detection, ptrace detection (/proc/self/status parsing), and execution inside a forked child process. The crux of the challenge relies on mastering x86_64 32-bit relative branching (call rel32 and jmp rel32), Linux memory allocation behavior (mmap hints with and without MAP_FIXED), register state manipulation, and overcoming lightweight 3-bit Process ID (PID) entropy (pid & 7) to redirect control flow to a glibc one_gadget.