Writeups

• HTB

  TartarSauce

  A WordPress plugin RFI found through a directory robots.txt never lists, sudo tar abused via GTFOBins to pivot users, then a TOCTOU race against a root backup script to plant a setuid root shell.

• HTB

  DarkZero

  MSSQL linked server abuse across a cross-forest trust for foothold, a stolen named-pipe token to restore SeImpersonate for GodPotato to SYSTEM, then coerced authentication and unconstrained delegation to steal a domain controller's TGT and DCSync the other domain.

• HTB

  Pilgrimage

  ImageMagick arbitrary file read via an exposed .git directory, then binwalk path traversal RCE against a root antivirus script.

No posts match your search.