Approach
Every machine is worked manually — no automated exploitation beyond standard tooling like netexec or Impacket. The focus is understanding why something works, not just that it works. Techniques are researched before running, outputs are reviewed carefully, and each step is documented.
Completed Machines
Windows · AD · Fully pwned
DLL hijacking via a scheduled task for initial foothold. Rogue WSUS attack chain combined with ESC17 for escalation. Final credential extraction via secretsdump.
DLL hijacking
ESC17
Rogue WSUS
secretsdump
Scheduled task
Linux · Fully pwned
Enumeration of an exposed camera management service. Initial access through a vulnerable web interface, followed by privilege escalation to root on a Linux target.
Web enum
Linux privesc
Service abuse
Linux · User flag
Apache CXF SSRF/LFI via CVE-2022-46364. HoverFly credential exposure from config files. User flag obtained — root escalation via sudo path/library hijacking in progress.
CVE-2022-46364
SSRF / LFI
HoverFly
sudo hijack
Approach
Every machine is worked manually — no automated exploitation beyond standard tooling like netexec or Impacket. Each box gets a thorough initial run followed by clean methodology documentation and alternative path exploration where applicable.
01
Enumeration first — full port scan, service fingerprinting, directory brute-force where applicable before touching any exploit.
02
Manual exploitation — understand the vulnerability before running it. Payload crafting, debugging, and adapting publicly known techniques to the specific environment.
03
Clean documentation — commands, outputs, and reasoning written up per machine. Useful for portfolio evidence and future reference when a similar technique appears in a real engagement.