Write-ups
Penetration testing walkthroughs from TryHackMe boxes and CTF challenges.
K2 Base Camp
Chained stored XSS, admin session hijacking, and SQL injection to compromise credentials, then escalated to root via log analysis.
Lookback
Exploited default credentials and command injection to gain a foothold, then escalated using a Metasploit module for a known MS Exchange vulnerability.
Silver
Used a documented Silverpeas authentication bypass (CVE-2024-36042) and an IDOR vulnerability to move from unauthenticated access to root.
Thompson
Leaked Tomcat Manager credentials via a stock 401 error page, deployed a malicious WAR payload for a reverse shell, then escalated to root through a world-writable script invoked by a root cron job.
Billing
Exploited an unauthenticated RCE in MagnusBilling to land an initial shell, then escalated to root by injecting a malicious fail2ban action triggered through failed SSH attempts.