HHareeshwar N K1d ago · 6 min readPATH Hijacking a SUID Log Rotator: From Tokyo to rootTL;DR Target/Lab: Berlin's Locker, a 250-point exploitation challenge from the authorized Synchrony CTF R2 / Operation Red Cipher lab environment. Initial access was an SSH shell as tokyo. Vulnerabilhareeshwarnk.hashnode.dev
YYogeshwar PeelaOct 17 · 27 min readHackTheBox: Odori WriteupSummary Odori ships as an offline forensics box: the only live services are SSH and Samba, and an anonymously readable backup share just points to a BitLocker-encrypted VMDK handed out with the machinexploitnotes.hashnode.dev
YYogeshwar PeelaOct 12 · 8 min readTryHackMe: PlottedTMS WriteupSummary Plotted is a Linux CTF box hosting a PHP "Traffic Offense Management System" (TOMS) admin panel across two web services (ports 80 and 445). Initial enumeration uncovered decoy files and a leakexploitnotes.hashnode.dev
YYogeshwar PeelaOct 12 · 7 min readTryHackMe: Gallery WriteupSummary Gallery is a Linux box running a "Simple Image Gallery System" PHP application on port 8080. The login form is vulnerable to a classic SQL injection auth bypass, which grants admin access. Theexploitnotes.hashnode.dev
YYogeshwar PeelaOct 7 · 15 min readTryHackMe - SeaSurfer writeupExecutive Summary The engagement began with a single disclosed virtual host name leaking out of an HTTP response header on the target web server. That one leak unraveled the entire box: it led to a Woexploitnotes.hashnode.dev
YYogeshwar PeelaSep 28 · 8 min readTryHackMe: Binary Heaven - WriteupSummary A locked-down TryHackMe box gating SSH access behind two credential-checking binaries: a small C program with an anti-debug/obfuscated string comparison, and a statically linked Go binary hidiexploitnotes.hashnode.dev
YYogeshwar PeelaSep 22 · 11 min readTryHackMe: Adventure Time WriteupSummary Adventure Time is a hard-rated TryHackMe box themed around the cartoon, with a heavy focus on multi-layered encoding/decoding puzzles, steganography, and lateral movement through several user exploitnotes.hashnode.dev
YYogeshwar PeelaSep 22 · 8 min readTryHackMe: Python Playground WriteupSummary Python Playground is a hard-rated TryHackMe box built around a "sandboxed" Python code execution service fronted by a Node.js/Express web app. The site advertises a blacklist-based filter thatexploitnotes.hashnode.dev
YYogeshwar PeelaSep 10 · 10 min readTryHackMe - Olympus WriteupSummary Olympus is a Linux box built around an old Victor CMS 1.0 install hidden under /~webmaster/. An unauthenticated SQL injection in the CMS search feature was the root of the entire chain: it dumexploitnotes.hashnode.dev
YYogeshwar PeelaAug 24 · 9 min readTryHackMe : Umbrella WriteupIntroduction Umbrella is a medium-difficulty TryHackMe box built around a leaky Docker registry, an exposed Node.js time-tracking application, and a classic writable-log privilege escalation. The pathexploitnotes.hashnode.dev
