2026-09-10 7 min
[writeup]
Ronin66 Recovery Writeup
An SMB null session leaks a password in a description field, then Shadow Credentials, a credential buried in a custom binary, a Kerberoast and RBCD over the DC.
tail -f /var/log/hos
retired boxes, exploit notes, tooling we wrote because nothing else did the job.
324
posts
11
authors
weekly
cadence
grep all HackTheBox OSCP Preparation Privilege Escalation Linux Web Windows RCE Easy Active Directory Information Disclosure SSH Medium
> latest
2026-09-10 7 min
[writeup]
Ronin66 Poet Writeup
A Flask note library hands out any local file, /proc/self/environ leaks the admin secret, render_template_string gives a shell, and a SUID fetcher writes UID 0.
2026-09-10 4 min
[notes]
HackingClub Umbrella (Difícil Linux): Stats e Writeup
HackingClub Umbrella: máquina difícil de Linux ativa, 2h38m de intervalo mediano entre as flags, o maior de toda a rotação, e 28,6% de abandono.
AD
2026-09-10 5 min
[notes]
HackingClub Planetary (Médio Linux): Stats e Writeup
HackingClub Planetary: máquina média de Linux ativa, first blood do dumahgrind em 15m46s, e a flag mais difícil caiu primeiro em 8 das 11 conclusões.
AD
2026-09-09 7 min
[writeup]
Ronin66 Buoy Writeup
Anonymous FTP exposes a Roundcube backup with database credentials, CVE-2025-49113 gives code execution, and a root cron running tar with a wildcard roots it.