Brunner Mifflin (Root)
IT terminal creds + sudo NOPASSWD on /usr/bin/mail. GTFOBins payload spawns a root shell for the flag.
$ Writeup
Brunner Mifflin (User)
IDOR + broken access control in an HR web app. Manipulate a client-side role in localStorage to unlock admin access and grab the flag.
Force Push
A force-push hid a commit, but ORIG_HEAD and the dangling object survived. Recovered the leaked reliquary credentials.
The Compressed Truth
Analyzing NTUSER.DAT hives with RegRipper to trace CROWQUILL's stolen-credential access to vmarr's machine, uncovering KeeFarce credential theft and a staged/exfiltrated archive via 7-Zip artifacts.
Massagold
Stored XSS via unescaped EJS output, CSP bypassed using a Google JSONP endpoint, payload delivered to an admin bot that exfiltrated the flag from the admin inbox back to us.
Gatery
An Elysia backend's signed session cookie fails to verify signatures (CVE-2025-66457), letting a forged session=inside cookie bypass auth.
Line Tap
Fingerprinted a Telnet service running vulnerable GNU InetUtils telnetd, exploited CVE-2026-24061 via USER env injection to bypass auth and grab root shell + flag.
Baby
Anonymous LDAP enumeration exposes domain users. Password spraying identifies a second account. SeBackupPrivilege is abused to extract ntds.dit, leading to a full domain compromise via Pass-the-Hash.
Conversor
An unsanitized XSLT parser allows arbitrary file writes for RCE. Credentials are recovered from a SQLite database. A Perl config injection grants a root shell.
WingData
A null-byte injection CVE-2025-47812. Credentials for a second user are recovered from config files. A symlink and hardlink chaining technique CVE-2025-4517.