M4cCrypt0
M4cCrypt0

// hack. learn. repeat. — notes, writeups and lab journal on the road to freelance security work.

$ grep -ri
all binary exploitation (8) blue-team (3) ctf (13) forensics (3) hardware (2) privilege escalation (3) python (3) red team (13) thm (12) walkthrough (10) web-exploitation (6) cloud (1) cryptography (1) foundation (1) lab (1)

August 2026

2026-08-10 writeup ctfthmwalkthroughweb-exploitation

Guestbook: Cross-Entry Prompt Injection to RCE (VERA)

Guestbook is a TryHackMe room (AI/Web, 90 pts, Medium) built around VERA, an LLM concierge that "reviews" guestbook entries and treats each one as an instruction rather than data. VERA exposes four…
2026-08-06 writeup ctfPrivilege Escalationthmwalkthroughweb-exploitation

Byte Lotus: Infinity Pool — Two Shells, One Voicemail

Two shells on one box — a public-facing command injection, then a root-owned automation API reachable only on loopback — bridged by a Bearer token left in a FreePBX voicemail caller-ID field.
2026-08-06 writeup ctfthmwalkthroughweb-exploitation

Zip Slip to RCE: The Hollow Shell

Web room: a hotel admin portal accepts .zip "shell" packs; default creds leak in an HTML comment and a Zip Slip path traversal in the extractor lands a payload for RCE.
2026-08-05 writeup Red Teamweb-exploitation

Ponzi — Race Condition in Daily Reward Claim (difficulty: Medium)

Target app: Ponzi, a fictional crypto-rewards app ("wellness portal, poolside edition") with a daily claim mechanism. Goal: prove the 24-hour cooldown on the daily reward can be bypassed via a race condition and pull the flag from the Whale Vault.
2026-08-04 writeup Privilege EscalationRed Teamweb-exploitation

Byte Lotus — Poolside (Boot2Root, Medium)

Medium Boot2Root with a poolside/crypto theme. The box chains five separate vulnerabilities: NoSQL injection for auth bypass, Server-Side Template Injection for RCE, and a misconfigured Node.js Inspector plus group membership for privilege escalation to root.
2026-08-03 writeup Privilege EscalationpythonRed Teamthmweb-exploitation

TryHackMe Resort write-up

Boot2Root via unsafe YAML deserialization (yaml.load RCE) on a Flask jukebox app, a dash-vs-bash reverse-shell pitfall, and privilege escalation from a root password leaked in a process command line.