HackTheBox: Odori WriteupSummary Odori ships as an offline forensics box: the only live services are SSH and Samba, and an anonymously readable backup share just points to a BitLocker-encrypted VMDK handed out with the machin6d ago · 22 min readexploitnotes.hashnode.dev
TryHackMe: Gallery WriteupSummary Gallery is a Linux box running a "Simple Image Gallery System" PHP application on port 8080. The login form is vulnerable to a classic SQL injection auth bypass, which grants admin access. TheOct 12 · 7 min readexploitnotes.hashnode.dev
TryHackMe: PlottedTMS WriteupSummary Plotted is a Linux CTF box hosting a PHP "Traffic Offense Management System" (TOMS) admin panel across two web services (ports 80 and 445). Initial enumeration uncovered decoy files and a leakOct 12 · 8 min readexploitnotes.hashnode.dev
TryHackMe: MD2PDF WriteupSummary MD2PDF is a web app that converts user-submitted Markdown into a downloadable PDF using a server-side rendering engine. The input is not sanitized, so raw HTML is rendered as-is - including taOct 7 · 9 min readexploitnotes.hashnode.dev
TryHackMe - SeaSurfer writeupExecutive Summary The engagement began with a single disclosed virtual host name leaking out of an HTTP response header on the target web server. That one leak unraveled the entire box: it led to a WoOct 7 · 15 min readexploitnotes.hashnode.dev
