2026-01-22 4 min
[writeup]
OffSec Proving Grounds Slort Writeup (Windows)
Windows box. index.php includes whatever the page parameter names, so a remote PHP shell runs as rupert, and a writable Backup folder swaps TFTP.EXE for admin.
tail -f /var/log/hos
retired boxes, exploit notes, tooling we wrote because nothing else did the job.
324
posts
11
authors
weekly
cadence
grep all HackTheBox OSCP Preparation Privilege Escalation Linux Web Windows RCE Easy Active Directory Information Disclosure SSH Medium
> latest
2026-01-22 3 min
[writeup]
OffSec Proving Grounds Nagoya Writeup
Windows AD Proving Grounds box. A password spray finds andrea.hayes, kerberoast and GenericAll reach WinRM, and a silver ticket plus GodPotato gives SYSTEM.
2026-01-21 7 min
[writeup]
Hack The Box LustrousTwo Writeup (Hard Windows)
Hard Windows AD box. Anonymous FTP leaks the user list, Summer2024! sprays into Emma.Bell, and a Kerberos only web app exposes a file download LFI.
2026-01-20 4 min
[writeup]
OffSec Proving Grounds Extplorer Writeup
Linux target. A fresh WordPress install points at an attacker database, a vulnerable plugin uploads a shell, and the disk group reads root's hash from shadow.
2026-01-20 5 min
[writeup]
OffSec Proving Grounds Shenzi Writeup
Windows target. A guest SMB share leaks WordPress passwords, the 404 theme template becomes a web shell, and AlwaysInstallElevated hands over SYSTEM.