M4cCrypt0
M4cCrypt0

// hack. learn. repeat. — notes, writeups and lab journal on the road to freelance security work.

$ grep -ri
all binary exploitation (8) blue-team (3) ctf (13) forensics (3) hardware (2) privilege escalation (3) python (3) red team (13) thm (12) walkthrough (10) web-exploitation (6) cloud (1) cryptography (1) foundation (1) lab (1)

August 2026

2026-08-06 writeup ctfPrivilege Escalationthmwalkthroughweb-exploitation

Byte Lotus: Infinity Pool — Two Shells, One Voicemail

Two shells on one box — a public-facing command injection, then a root-owned automation API reachable only on loopback — bridged by a Bearer token left in a FreePBX voicemail caller-ID field.
2026-08-04 writeup Privilege EscalationRed Teamweb-exploitation

Byte Lotus — Poolside (Boot2Root, Medium)

Medium Boot2Root with a poolside/crypto theme. The box chains five separate vulnerabilities: NoSQL injection for auth bypass, Server-Side Template Injection for RCE, and a misconfigured Node.js Inspector plus group membership for privilege escalation to root.
2026-08-03 writeup Privilege EscalationpythonRed Teamthmweb-exploitation

TryHackMe Resort write-up

Boot2Root via unsafe YAML deserialization (yaml.load RCE) on a Flask jukebox app, a dash-vs-bash reverse-shell pitfall, and privilege escalation from a root password leaked in a process command line.