August 2026
Production Hardware Protection Circuits
Seven protection circuits every board needs before it leaves the prototype stage, with the part to drop in for each.
Management Wants a Word: DPAPI All the Way Into a VeraCrypt Vault
Housekeeping found a guest laptop after an early checkout. Room 214, registered to vera. IT pulled a full KAPE triage before wiping it. The room is Forensics / Hard, and the whole thing is one long c…
Guestbook: Cross-Entry Prompt Injection to RCE (VERA)
Guestbook is a TryHackMe room (AI/Web, 90 pts, Medium) built around VERA, an LLM concierge that "reviews" guestbook entries and treats each one as an instruction rather than data. VERA exposes four…
Fileless WMI Persistence: Hunting a Hijacked CIM Class (TryHackMe: After Hours
Turned out to be a fileless persistence chain: a legit-looking WMI class carrying a Deflate-compressed .NET loader as a "static property", fired by an EventFilter / CommandLineEventConsumer pair with…
Byte Lotus: Infinity Pool — Two Shells, One Voicemail
Two shells on one box — a public-facing command injection, then a root-owned automation API reachable only on loopback — bridged by a Bearer token left in a FreePBX voicemail caller-ID field.
Zip Slip to RCE: The Hollow Shell
Web room: a hotel admin portal accepts .zip "shell" packs; default creds leak in an HTML comment and a Zip Slip path traversal in the extractor lands a payload for RCE.
CryptoCabana Kiosk — Cloud CTF Writeup
CryptoCabana is a kiosk web app that lets visitors "back up" their crypto wallet seed phrase with one click. The objective: find out what the kiosk quietly trusts to reach into Azure storage on its own, and see how far that trust extends.
Ponzi — Race Condition in Daily Reward Claim (difficulty: Medium)
Target app: Ponzi, a fictional crypto-rewards app ("wellness portal, poolside edition") with a daily claim mechanism. Goal: prove the 24-hour cooldown on the daily reward can be bypassed via a race condition and pull the flag from the Whale Vault.
Byte Lotus — Poolside (Boot2Root, Medium)
Medium Boot2Root with a poolside/crypto theme. The box chains five separate vulnerabilities: NoSQL injection for auth bypass, Server-Side Template Injection for RCE, and a misconfigured Node.js Inspector plus group membership for privilege escalation to root.
TryHackMe Resort write-up
Boot2Root via unsafe YAML deserialization (yaml.load RCE) on a Flask jukebox app, a dash-vs-bash reverse-shell pitfall, and privilege escalation from a root password leaked in a process command line.
July 2026
DFIR Cheatsheet — Windows Registry & Filesystem Artifacts
Reference card for Windows forensics: where to find evidence of execution, staging and exfiltration. Based on the classic "kill chain" order: Execution → Persistence → Access → Collection → Exfiltration.
Format String Exploit — GOT Overwrite to win()
Remote pwn challenge with a format string vulnerability instead of a classic buffer overflow. Goal: get a shell via an uncalled win() function, despite modern binary protections (no canary, but NX and CET).
TryPwnMeOne - TheLibrarian (ret2libc)
Remote binary exploitation challenge. Target: thelibrarian, running on MACHINEIP:9008, with matching libc.so.6 and ld-linux-x86-64.so.2 provided alongside the binary.
TryPwnMeOne: Random Memories — Write-up
A PIE ret2win: the binary leaks its own vuln() address (breaking ASLR), a 512-byte read into a 256-byte buffer overflows the stack, and an extra ret gadget fixes alignment before system() — ending in a root shell.
Workflow: finding a binary exploit blind (from zero to shell)
Starting point: you have a binary (and/or an IP:port), no other context. This order takes you systematically from recon to shell.
Shellcode Injection — Executable Stack (port 9005)
Third challenge: instead of overwriting a specific value, the entire contents of a buffer are executed as machine code. By sending your own shellcode, you get a full shell on the target.
TryOverFlowMe2 — Buffer Overflow with Variable Overwrite (port 9004)
Harder variant of the first overflow challenge. Instead of a simple overflow, a specific local variable (admin) has to be overwritten with an exact value (0x59595959) to reach the flag function.
TryOverFlowMe1 — Simple Buffer Overflow (port 9003)
First challenge in the TryPwnMeOne room. A netcat-like service on port 9003 asks for a "comment". Just sending a long string overflows the buffer on the stack and hands you the flag directly.
Ret2Win with Stack-Alignment Fix (CET/SHSTK)
A classic ret2win where the room''s hint gets both the offset and the alignment wrong: char *buf[0x20] is a pointer array (264-byte offset), and a CET-compiled binary needs an extra ret gadget to fix stack alignment before system().
June 2026
Proxmox lab network set up: isolated vmbr1
First step in the lab — a second virtual bridge with no IP and no physical ports, so vulnerable VMs can never touch the home network.
OSINT playbook
Methodology and tooling for passive recon on companies/domains and people, plus a checklist per engagement.
Nmap basics: host discovery and port scanning
Notes on the first scans against Metasploitable: -sn for discovery, -sV for service versions, and when -p- is needed.
Incident response runbook
The six IR phases, what to do (and not do) in the first hour, and which log sources to check first.
Hardware hacking gadgets: Pwnagotchi, Bjorn, Marauder and more
What Pwnagotchi, Bjorn, ESP32 Marauder/Cardputer and similar gadgets (Flipper Zero, WiFi Pineapple, Proxmark3, HackRF etc.) do, how they work, and whether to buy or build them yourself.
Cheatsheet: tool overview
Quick reference for Nmap, Burp Suite, Hashcat, Gobuster/ffuf and Wireshark filters.
Cheatsheet: shell commands
cmd.exe, PowerShell and Linux/Unix side by side: navigation, searching, processes, network and permissions.
Bug bounty playbook
Workflow from recon to report, high-yield vulnerability classes, and how to write a report that doesn't get rejected as a duplicate.