CTF Writeups
HackTheBox and lab walkthroughs with practical exploitation steps.
Focused writeups from boxes and labs I solved, including enumeration flow, exploit path, and privilege escalation notes.
Sea
PORT STATE SERVICE VERSION 21/tcp open ftp vsftpd 3.0.5 | ftp-syst: | STAT: | FTP server status: | Connected to 192.168.45.159 | Logged in as ftp | TYPE: ASCII | No session …
Payday
easy RCE and privesc with same user same pass and sudo all.
Ochima
tarting Nmap 7.95 ( https://nmap.org ) at 2026-03-26 09:53 EDT Nmap scan report for 192.168.143.32 Host is up (0.083s latency). Not shown: 65532 filtered tcp ports (no-response) PORT STATE SERVICE VERSION …
CVE-2023-6019
man this was literally the title and 1 click how is it intermediate.
Jordak
simple RCE with public exploit and then privesc with env variable sudo perm.
BitLocker
Exposed creds updated mysql db pass to work w authenticated rce and then privesc with creds in a process and thensudo perms over .py.
SPX
RCE through SPX version and key leaked in phpinfo, privesc with sudo perms over make.
Plum
22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0) | ssh-hostkey: | 3072 c9:c3:da:15:28:3b:f1:f8:9a:36:df:4d:36:6b:a7:44 (RSA) | 256 26:03:2b:f6:da:90:1d:1b:ec:8d:8f:8d:1e:7e:3d:6b (ECDSA) …
Workaholic
initial access with wordpress plugin sqli and then privesc with suid that needed compiling a library with a plugin.
PyLoader
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.1 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 b9:bc:8f:01:3f:85:5d:f9:5c:d9:fb:b6:15:a0:1e:74 (ECDSA) |_ 256 …
Flu
Nmap was my starting point here, and the service/version clues below shaped the next checks.
RubyDome
nmap 192.168.243.22 -sCV -Pn -p- -A --min-rate=20000 Starting Nmap 7.95 ( https://nmap.org ) at 2026-03-22 10:01 EDT Nmap scan report for 192.168.243.22 Host is up (0.079s latency). Not shown: 65533 closed …
Scrutiny
Nmap was my starting point here, and the service/version clues below shaped the next checks.
Press
Initial access with default creds and magic byte file upload bypass, privesc with gtfobins.
pc
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.9 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 3072 62:36:1a:5c:d3:e3:7b:e1:70:f8:a3:b3:1c:4c:24:38 (RSA) | 256 …
LaVita
This writeup covers the full attack path for LaVita, including enumeration, exploitation, and privilege escalation.
Fired
ORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 3072 …
law
Web behavior was the main signal here, so I traced each response change before exploitation.