YPYogeshwar Peelainexploitnotes.hashnode.dev·17h ago · 17 min readTryHackMe : BreakMe WriteupSummary BreakMe is a Debian box running Apache with a WordPress install under /wordpress. A vulnerable plugin (WP Data Access 5.3.5) lets a low-privileged WordPress user escalate to Administrator by t00
YPYogeshwar Peelainexploitnotes.hashnode.dev·4d ago · 6 min readTryHackMe : Towel on the Sunbed WriteupTL;DR Ponzi Portfolio is a Node.js/Express "staking rewards" web app with a 24-hour cooldown on claiming a reward. The /claim endpoint has a classic check-then-act race condition: it checks whether th10
YPYogeshwar Peelainexploitnotes.hashnode.dev·Jul 17 · 19 min readHackTheBox : Race WriteupSummary Race is a Linux box built around Grav CMS. The path in is a chain of small information leaks rather than one big bug: an exposed phpsysinfo instance with default creds leaks a process list, th00
