<Tag: writeup />

In this Hack The Box challenge, I had to act as a backup pass prediction system for a ground station. By parsing Two-Line Element (TLE) sets and calculating satellite passes above 30 degrees of elevation using Python's `skyfield` library, I wrote an automated solver to determine upcoming visibility windows, overcome strict timing checks, and retrieve the flag.

A premium archery store whose new-member '\$300 welcome credit' is applied at checkout through a check-then-act race. The redeem endpoint reads a one-time flag, pauses to 'authorize', then adds the credit and sets the flag — so concurrent redeems all pass the check and each adds \$300. By stacking the credit past an item's price and placing the order, the confirmation page renders the flag as a gift.

I found that Gilt & Grain's Members Portal authenticated against an unescaped LDAP filter, letting me bypass login entirely with a wildcard payload that matched any directory entry instead of verifying real credentials. The bug came down to the app treating "a matching record was found" as proof of a correct password, rather than performing an actual LDAP bind to check it.

A hunt through a resort's offline WMI repository that traces a fileless backdoor from a "clean" event-log binding down through Base64-and-UTF16-encoded PowerShell, a reflectively-loaded .NET payload hidden in a custom Win32_HardwareTelemetry class, and a quietly planted net user backdoor account.

Compromising the ShadowGate Active Directory lab through a chained attack path — from AS-REP roasting and ACL abuse via Shadow Credentials, to coercing the Domain Controller with PetitPotam and relaying its authentication into a certificate-based DCSync — culminating in full domain compromise via the krbtgt hash.