hc0n Christmas CTF
A long-form challenge chaining web enumeration, CBC padding-oracle abuse, credential discovery, binary analysis, and buffer overflow exploitation.
TryHackMe
Writeups
Agent P
A multi-stage chain moves from WordPress SQL injection through database credentials, unsafe pickle loading, and a signed-task binary to root.
Lost Fortune Included
A PHP stream-wrapper bypass defeats the document whitelist and reads arbitrary files from the server.
B1t Recovery
Known plaintext from the THM flag prefix recovers a reused four-byte XOR key and decrypts the challenge file.
Casino Heist
Packet-capture analysis and PyInstaller reverse engineering recover the key used to decrypt exfiltrated jackpot data.
Fresh Powder
A detection-as-code investigation repairs five broken Sigma rules and validates each fix against the incident report.
Beach Bar
Leaked credentials lead to unsafe YAML deserialization, remote code execution, and Linux privilege escalation.
Do Not Disturb
A NoSQL authentication bypass opens an EJS SSTI path, followed by debugger hijacking and privilege escalation.
Hollow Shell
Default credentials and a Zip Slip upload escape the theme directory and turn an automation hook into code execution.
Infinity Pool
Command injection in a legacy network-check endpoint leads through internal services to full compromise.
Room 404
An exposed .git directory leaks the staging source and a flag left in the repository.
The Guestbook
Prompt injection against an AI concierge reveals hidden directives and bypasses output redaction.
Towel on the Sunbed
A race condition lets parallel reward claims bypass the 24-hour lock and open the Whale Vault.
Eavesdropper
SSH access as Frank and process monitoring with pspy reveal credentials used for root privilege escalation.
Umbrella
An exposed Docker registry leaks database credentials, leading through cracked hashes, command injection, and a privileged container to root.
Cupid’s Matchmaker
Stored XSS in a matchmaking survey steals the reviewer’s session cookie and exposes the flag.
Corp Website
CVE-2025-55182 provides remote code execution before a permissive sudo path completes privilege escalation.
CupidBot
The bot leaks its verification code, which can be replayed to authorize disclosure of all three challenge flags.
Speed Chatting
An unrestricted profile-image upload accepts executable Python and turns a chat account into a reverse shell.
TryHeartMe
An improperly protected JWT lets a normal shopper forge an admin role and redeem the staff-only flag.
When Hearts Collide
A broken MD5-based image matcher can be defeated with a collision to force a successful match.
Love Letter Locker
An insecure direct object reference exposes another user’s private letter—and the flag—by changing its numeric ID.
