I work in offensive security. Here I share CTF writeups, security notes and small projects.
Active machine — write-up published after retirement.
Active machine — write-up published after retirement.
Overview Odori is a medium-difficulty Linux machine that blends Windows forensics with Linux privilege escalation. The foothold is not found on the live host at all - an anonymous Samba share points to a BitLocker-encrypted .vmdk disk image that has to be cracked offline, mounted, and mined for Windows secrets. Inside the image, DPAPI-protected credentials for the svc_backup service account are recovered through a chain of standard offline techniques (hive parsing, an offline Administrator password reset, and mimikatz DPAPI decryption). ...
Active machine — write-up published after retirement.
Active machine — write-up published after retirement.
Active machine — write-up published after retirement.
Active machine — write-up published after retirement.
Active machine — write-up published after retirement.
Active machine — write-up published after retirement.
Overview Stack: Ubuntu 24, WordPress 7.0, SQLite. 1 2 3 4 5 6 7 8 9 10 11 12 13 reconnaissance v audio file discloses Jake's password (a restricted WP user) v hardcoded client-side AES-GCM key -> stored XSS in the admin panel v XSS creates an administrator account v admin -> Theme File Editor -> PHP webshell -> RCE (www-data) v wp-config.php -> walter's credentials -> SSH -> user.txt v local OCR service (PHP as root) -> write PHP -> RCE as root -> root.txt Reconnaissance 1 2 3 4 nmap -sV -p- 10.10.10.x --min-rate 5000 # open: 22/tcp (SSH), 443/tcp (HTTPS) wpscan --url https://makesense.htb --enumerate u,vp,vt --disable-tls-checks Key wpscan findings: ...