YPYogeshwar Peelainexploitnotes.hashnode.dev·3d ago · 5 min readTryHackMe : The Hollow ShellOverview The Hollow Shell is a Flask app ("Shoreline Display - Room Service") that lets an authenticated concierge upload themed "shells" as .zip archives. Each archive must contain a shell.json manif10
YPYogeshwar Peelainexploitnotes.hashnode.dev·5d ago · 7 min readTryHackMe : CryptoCabana WriteupOverview CryptoCabana is a fake crypto-backup service hosted as an Azure Static Website. The attack path chains together four separate misconfigurations: A low-privilege Azure user with only Reader o10
YPYogeshwar Peelainexploitnotes.hashnode.dev·5d ago · 6 min readTryHackMe : Towel on the Sunbed WriteupTL;DR Ponzi Portfolio is a Node.js/Express "staking rewards" web app with a 24-hour cooldown on claiming a reward. The /claim endpoint has a classic check-then-act race condition: it checks whether th10
YPYogeshwar Peelainexploitnotes.hashnode.dev·6d ago · 5 min readTryHackMe : Overheard at BreakfastTL;DR A single artifact - a zipped screenshot of a Discord-style DM conversation is the entire challenge. Two "Byte Lotus Hotel" guests, Ponzi and Lambo!, chat about social media; Lambo! name-drops a10
YPYogeshwar Peelainexploitnotes.hashnode.dev·6d ago · 6 min readTryHackMe : Packed Light WriteupTL;DR A .pcapng capture shows a victim host on 192.168.1.141 downloading a Python keylogger (updates.py) from an attacker-controlled "hotel update server" at byte-lotus-hotel.thm:8080 (34.41.103.191).10
YPYogeshwar Peelainexploitnotes.hashnode.dev·6d ago · 7 min readTryHackMe : Beach Bar WriteupTL;DR Beach Bar is a Flask-based "DJ booth" web app for a beach bar jukebox. Default demo credentials (dj/dj) left enabled in an HTML comment get you into the dashboard, which exposes a YAML playlist 10
YPYogeshwar Peelainexploitnotes.hashnode.dev·Jul 24 · 18 min readTryHackMe : Enterprise WriteupSummary Enterprise is an Active Directory box that starts as a classic external AD footprint (DNS, Kerberos, LDAP, SMB, RDP, WinRM) plus two extra web ports: an IIS site on 80 and a Bitbucket-branded 10
YPYogeshwar Peelainexploitnotes.hashnode.dev·Jul 22 · 10 min readTryHackMe : Fool's Mate RevengeSummary This is the sequel to the original Endgame Trainer box. The developer clearly read that writeup - the client-side "don't let the player actually win" gate is gone entirely, and the win conditi10
YPYogeshwar Peelainexploitnotes.hashnode.dev·Jul 22 · 8 min readTryHackMe : FoolMate WriteupSummary Endgame Trainer is a small web app that presents a "mate-in-one" chess puzzle. The board is legit (built on the chess.js library), but the app has a gimmick: if you actually play the winning m00
YPYogeshwar Peelainexploitnotes.hashnode.dev·Jul 14 · 9 min readHackTheBox : JinjaCareSummary JinjaCare is a Flask-based COVID-19 vaccination verification web app. The intended path chains wkhtmltopdf HTML/local-file injection (via the certificate-generation feature) to disclose the Fl00
