Baby
Anonymous LDAP enumeration exposes domain users. Password spraying identifies a second account. SeBackupPrivilege is abused to extract ntds.dit, leading to a full domain compromise via Pass-the-Hash.
2026-07-21 | Last updated
Cybersecurity
CTF Writeups
Projects
My little blog with writeups, setups, tools and notes from the offensive side of things.
Cybersecurity · CTF Writeups
$ Latest Writeups
Conversor
An unsanitized XSLT parser allows arbitrary file writes for RCE. Credentials are recovered from a SQLite database. A Perl config injection grants a root shell.
WingData
A null-byte injection CVE-2025-47812. Credentials for a second user are recovered from config files. A symlink and hardlink chaining technique CVE-2025-4517.
$ Projects
HTB CPTS Path
HTB Certified Penetration Testing Specialist (HTB CPTS) is a highly hands-on certification that assesses the candidates penetration testing skills.
11.9% complete
p4ss_g3n
A command-line password generator built in Python, focused on security-first design. Built as a learning Python project with the though of eventually evolving into a full password manager.
→ github