YPYogeshwar Peelainexploitnotes.hashnode.dev·1d ago · 11 min readTryHackMe : Infinity Pool WriteupSummary Recon on <MACHINE_IP> revealed a Gunicorn-hosted "Byte Lotus" hotel site with two paths disallowed in robots.txt - /internal/ and /status. The /status page exposes an internal staff tool ("Sis10
YPYogeshwar Peelainexploitnotes.hashnode.dev·2d ago · 5 min readTryHackMe : The Hollow ShellOverview The Hollow Shell is a Flask app ("Shoreline Display - Room Service") that lets an authenticated concierge upload themed "shells" as .zip archives. Each archive must contain a shell.json manif10
YPYogeshwar Peelainexploitnotes.hashnode.dev·4d ago · 7 min readTryHackMe : Beach Bar WriteupTL;DR Beach Bar is a Flask-based "DJ booth" web app for a beach bar jukebox. Default demo credentials (dj/dj) left enabled in an HTML comment get you into the dashboard, which exposes a YAML playlist 10
YPYogeshwar Peelainexploitnotes.hashnode.dev·Jul 22 · 10 min readTryHackMe : Fool's Mate RevengeSummary This is the sequel to the original Endgame Trainer box. The developer clearly read that writeup - the client-side "don't let the player actually win" gate is gone entirely, and the win conditi10
YPYogeshwar Peelainexploitnotes.hashnode.dev·Jul 18 · 4 min readFAM CTF : The Vault Door WriteupSummary NexaVault is a mock internal dashboard app that gates an "Admin Vault" panel behind a role claim in a JWT. The app issues a user-role token on login, stored in the nx_access cookie, and trusts00
YPYogeshwar Peelainexploitnotes.hashnode.dev·Jul 18 · 7 min readFAM CTF : The Cloud writeupSummary The target exposed a webhook endpoint (/internal/webhook) meant to act as an internal-only proxy, blocking direct requests to private and link-local IP ranges. That blocklist checked resolved 00
YPYogeshwar Peelainexploitnotes.hashnode.dev·Jul 17 · 4 min readHackTheBox : Void Whispers WriteupSummary The "Void Whispers" mail-settings panel passes the user-supplied sendMailPath field directly into shell_exec("which $sendMailPath") with no escaping. The app only filters literal whitespace, w00
YPYogeshwar Peelainexploitnotes.hashnode.dev·Jul 17 · 19 min readHackTheBox : Race WriteupSummary Race is a Linux box built around Grav CMS. The path in is a chain of small information leaks rather than one big bug: an exposed phpsysinfo instance with default creds leaks a process list, th00
YPYogeshwar Peelainexploitnotes.hashnode.dev·Jul 13 · 8 min readHackTheBox: NeoVault Challenge WriteupSummary NeoVault is a small banking app (Next.js frontend + REST API) that lets users register, transfer funds, and download PDF statements. The API ships in two parallel versions, v1 and v2. v2 patch00
YPYogeshwar Peelainexploitnotes.hashnode.dev·Jul 4 · 10 min readHackTheBox: Watcher WriteupSummary Watcher is a Linux box built around a self-hosted Zabbix monitoring stack. The front door isn't a permissions misconfig at all - it's a real Zabbix CVE (CVE-2024-22120), a time-based blind SQL00
