2026-01-10 5 min
[writeup]
OffSec Proving Grounds Cockpit Writeup
A SQL injection bypasses the login form, the dashboard behind it hands over base64 passwords for Cockpit on port 9090, and a sudo tar wildcard gives root.
tail -f /var/log/hos
retired boxes, exploit notes, tooling we wrote because nothing else did the job.
324
posts
11
authors
weekly
cadence
grep all HackTheBox OSCP Preparation Privilege Escalation Linux Web Windows RCE Easy Active Directory Information Disclosure SSH Medium
> latest
2026-01-10 5 min
[writeup]
OffSec Proving Grounds Clue Writeup (Linux)
Linux target. A Cassandra Web file read exploit exposes the FreeSWITCH event socket password for a shell, and cassie's id_rsa logs straight in as root.
2026-01-10 15 min
[writeup]
Hack The Box Browsed Writeup (Medium Linux)
Medium Linux box. An analysis log leaks an internal Gitea vhost, a malicious browser extension fires bash arithmetic injection, and a poisoned .pyc gives root.
2026-01-10 6 min
[writeup]
OffSec Proving Grounds Pelican Writeup
Linux Proving Grounds box. Exhibitor for ZooKeeper runs commands through its java.env field for a shell as charles, and sudo gcore dumps root's password.
2026-01-10 4 min
[writeup]
OffSec Proving Grounds Boolean Writeup
Linux Proving Grounds box. A mass assignment confirms the account, an LFI file manager writes remi's authorized_keys, and a root SSH alias gives root.