2026-01-27 11 min
[writeup]
OffSec Proving Grounds Medjed Writeup
Windows box running BarracudaDrive. WebDAV leaks the app database, a password reminder reset hijacks an account, and a writable folder swaps bd.exe for SYSTEM.
tail -f /var/log/hos
retired boxes, exploit notes, tooling we wrote because nothing else did the job.
324
posts
11
authors
weekly
cadence
grep all HackTheBox OSCP Preparation Privilege Escalation Linux Web Windows RCE Easy Active Directory Information Disclosure SSH Medium
> latest
2026-01-27 5 min
[writeup]
OffSec Proving Grounds Lavita Writeup
Laravel 8.4.0 with debug mode on falls to CVE-2021-3129, a writable artisan script hijacks a cron job as skunk, and sudo composer runs a script as root.
2026-01-26 4 min
[writeup]
OffSec Proving Grounds Hokkaido Writeup (AD)
Windows AD box. info:info opens the domain, SYSVOL leaks Start123!, MSSQL impersonation gives hrapp-service, and Server Operators dumps the SAM.
2026-01-25 10 min
[notes]
SOC338: Lumma Stealer e DLL side-loading via Click Fix
SOC338 no Let's Defend: Lumma Stealer entregue por Click Fix phishing, mshta e PowerShell, com carregamento lateral de DLL. Análise do alerta do EDR ao C2.
2026-01-22 4 min
[writeup]
OffSec Proving Grounds Law Writeup
Linux Proving Grounds box. htmLawed 1.2.5 CVE-2022-35914 gives a shell as www-data, and a root-run cleanup.sh owned by www-data escalates to root.