August 2026
Guestbook: Cross-Entry Prompt Injection to RCE (VERA)
Guestbook is a TryHackMe room (AI/Web, 90 pts, Medium) built around VERA, an LLM concierge that "reviews" guestbook entries and treats each one as an instruction rather than data. VERA exposes four…
Fileless WMI Persistence: Hunting a Hijacked CIM Class (TryHackMe: After Hours
Turned out to be a fileless persistence chain: a legit-looking WMI class carrying a Deflate-compressed .NET loader as a "static property", fired by an EventFilter / CommandLineEventConsumer pair with…
Byte Lotus: Infinity Pool — Two Shells, One Voicemail
Two shells on one box — a public-facing command injection, then a root-owned automation API reachable only on loopback — bridged by a Bearer token left in a FreePBX voicemail caller-ID field.
Zip Slip to RCE: The Hollow Shell
Web room: a hotel admin portal accepts .zip "shell" packs; default creds leak in an HTML comment and a Zip Slip path traversal in the extractor lands a payload for RCE.
CryptoCabana Kiosk — Cloud CTF Writeup
CryptoCabana is a kiosk web app that lets visitors "back up" their crypto wallet seed phrase with one click. The objective: find out what the kiosk quietly trusts to reach into Azure storage on its own, and see how far that trust extends.
July 2026
Format String Exploit — GOT Overwrite to win()
Remote pwn challenge with a format string vulnerability instead of a classic buffer overflow. Goal: get a shell via an uncalled win() function, despite modern binary protections (no canary, but NX and CET).
TryPwnMeOne - TheLibrarian (ret2libc)
Remote binary exploitation challenge. Target: thelibrarian, running on MACHINEIP:9008, with matching libc.so.6 and ld-linux-x86-64.so.2 provided alongside the binary.
TryPwnMeOne: Random Memories — Write-up
A PIE ret2win: the binary leaks its own vuln() address (breaking ASLR), a 512-byte read into a 256-byte buffer overflows the stack, and an extra ret gadget fixes alignment before system() — ending in a root shell.
Workflow: finding a binary exploit blind (from zero to shell)
Starting point: you have a binary (and/or an IP:port), no other context. This order takes you systematically from recon to shell.
Shellcode Injection — Executable Stack (port 9005)
Third challenge: instead of overwriting a specific value, the entire contents of a buffer are executed as machine code. By sending your own shellcode, you get a full shell on the target.
TryOverFlowMe2 — Buffer Overflow with Variable Overwrite (port 9004)
Harder variant of the first overflow challenge. Instead of a simple overflow, a specific local variable (admin) has to be overwritten with an exact value (0x59595959) to reach the flag function.
TryOverFlowMe1 — Simple Buffer Overflow (port 9003)
First challenge in the TryPwnMeOne room. A netcat-like service on port 9003 asks for a "comment". Just sending a long string overflows the buffer on the stack and hands you the flag directly.
Ret2Win with Stack-Alignment Fix (CET/SHSTK)
A classic ret2win where the room''s hint gets both the offset and the alignment wrong: char *buf[0x20] is a pointer array (264-byte offset), and a CET-compiled binary needs an extra ret gadget to fix stack alignment before system().