August 2026
Management Wants a Word: DPAPI All the Way Into a VeraCrypt Vault
Housekeeping found a guest laptop after an early checkout. Room 214, registered to vera. IT pulled a full KAPE triage before wiping it. The room is Forensics / Hard, and the whole thing is one long c…
Guestbook: Cross-Entry Prompt Injection to RCE (VERA)
Guestbook is a TryHackMe room (AI/Web, 90 pts, Medium) built around VERA, an LLM concierge that "reviews" guestbook entries and treats each one as an instruction rather than data. VERA exposes four…
Fileless WMI Persistence: Hunting a Hijacked CIM Class (TryHackMe: After Hours
Turned out to be a fileless persistence chain: a legit-looking WMI class carrying a Deflate-compressed .NET loader as a "static property", fired by an EventFilter / CommandLineEventConsumer pair with…
Byte Lotus: Infinity Pool — Two Shells, One Voicemail
Two shells on one box — a public-facing command injection, then a root-owned automation API reachable only on loopback — bridged by a Bearer token left in a FreePBX voicemail caller-ID field.
Zip Slip to RCE: The Hollow Shell
Web room: a hotel admin portal accepts .zip "shell" packs; default creds leak in an HTML comment and a Zip Slip path traversal in the extractor lands a payload for RCE.
CryptoCabana Kiosk — Cloud CTF Writeup
CryptoCabana is a kiosk web app that lets visitors "back up" their crypto wallet seed phrase with one click. The objective: find out what the kiosk quietly trusts to reach into Azure storage on its own, and see how far that trust extends.
TryHackMe Resort write-up
Boot2Root via unsafe YAML deserialization (yaml.load RCE) on a Flask jukebox app, a dash-vs-bash reverse-shell pitfall, and privilege escalation from a root password leaked in a process command line.
July 2026
TryPwnMeOne: Random Memories — Write-up
A PIE ret2win: the binary leaks its own vuln() address (breaking ASLR), a 512-byte read into a 256-byte buffer overflows the stack, and an extra ret gadget fixes alignment before system() — ending in a root shell.
Shellcode Injection — Executable Stack (port 9005)
Third challenge: instead of overwriting a specific value, the entire contents of a buffer are executed as machine code. By sending your own shellcode, you get a full shell on the target.
TryOverFlowMe2 — Buffer Overflow with Variable Overwrite (port 9004)
Harder variant of the first overflow challenge. Instead of a simple overflow, a specific local variable (admin) has to be overwritten with an exact value (0x59595959) to reach the flag function.
TryOverFlowMe1 — Simple Buffer Overflow (port 9003)
First challenge in the TryPwnMeOne room. A netcat-like service on port 9003 asks for a "comment". Just sending a long string overflows the buffer on the stack and hands you the flag directly.
Ret2Win with Stack-Alignment Fix (CET/SHSTK)
A classic ret2win where the room''s hint gets both the offset and the alignment wrong: char *buf[0x20] is a pointer array (264-byte offset), and a CET-compiled binary needs an extra ret gadget to fix stack alignment before system().