context lately while playing with CRTE lab, I got administrator in one of the machines, and used rubeus’s triage module to check kerberos tickets cached in memory to find the following: the inte...

conversor is an easy linux machine that involves web enumeration leading to a source code leak. The source code reveals a file upload path traversal vulnerability, which is exploited to write a P...

expressway is an easy Linux box running isakmp over UDP. By abusing aggressive mode, I cracked the pre-shared key and used it to authenticate via SSH. During post-exploitation, I discovered two d...

Introduction first seen on 0x00sec CVE-2025-27591 is a Local Privilege Escalation (LPE) vulnerability affecting below, a time-traveling resource monitor for Linux developed by Facebook Incubator....

guardian is a hard Linux box, hosting a php based university website, this writeup involved leveraging default student credentials, session hijacking via CVE-2025-22131 (XSS) in phpspreadsheet, and...

Giveback is a medium Linux box from season 9, hosting a wordpress website on a kubernetes setup with a vulnerable plugin, which gives remote code execution on the wordpress pod, from there I found ...

soulmate is an easy Linux box running a crushftp instance vulnerable to CVE-2025-31161 auth bypass, I took advantage of it to add a new superuser so I can upload a revshell and get a shell as www-d...

signed is an assume-breach medium windows box from season 9, where I was given the credentials of scott, I was able to leak mssqlsvc netntlmv2 hash using xp_dirtree and crack it, then use the crede...

CodePartTwo is an easy Linux box, hosting an open source js2py sandbox vulnerable to RCE via CVE-2024-28397 sandbox escape, I exploited the CVE to gain initial foothold as app then cracked hashes i...

Imagery is a medium Linux box, running a Flask Python application, I exploited a stored XSS to steal the admin cookie and log in as admin on the website, then exploited an LFI in the admin panel to...