## https://sploitus.com/exploit?id=D1ADB465-0616-5353-B6E7-2D89B555850D
# CTF Writeups
Writeups from authorized OffSec labs, with more labs and CTFs to be added over time.
The reports are organized around reconnaissance, enumeration, initial access, and privilege
escalation. Commands and payloads are included where they make the work reproducible, while
flags and challenge answers are intentionally omitted.
> All testing documented here was performed against systems I was explicitly authorized to
> assess. The material is shared for educational and portfolio purposes.
## Completed writeups
| Machine | Platform | Attack path |
| --- | --- | --- |
| [Brine](./brine/) | Linux | Exposed Git repository, unsafe pickle deserialization, leaked file descriptor, `disk` group abuse |
| [Butch](./butch/) | Windows | Time-based SQL injection, unrestricted handler upload, code execution as `SYSTEM` |
| [Covfefe](./Covfefe/) | Linux | Exposed home directory, recovered SSH key, SUID buffer overflow |
| [LazySysAdmin](./LazySysAdmin/) | Linux | Anonymous SMB access, WordPress compromise, password reuse, unrestricted `sudo` |
| [Muddy](./muddy/) | Linux | SOAP XXE, WebDAV upload, cron `PATH` hijacking |
| [Scarecrow 1.1](./scarecrow1.1/) | Linux | XXE file read, SSRF, command injection, SUID `find` |
| [Sunset: Twilight](./sunset-twilight/) | Linux | File upload bypass, local file inclusion, writable `/etc/passwd` |
| [Vault](./vault/) | Windows / Active Directory | Forced authentication, NetNTLMv2 cracking, writable domain GPO |
## Skills demonstrated
- Network and service enumeration with RustScan, Nmap, SMB tooling, and content discovery
- Web exploitation involving SQL injection, XXE, SSRF, file inclusion, unsafe
deserialization, stored XSS, and upload-filter bypasses
- Linux privilege escalation through SUID binaries, writable system files, cron path
manipulation, inherited file descriptors, and weak `sudo` policy
- Windows and Active Directory exploitation through IIS, WinRM, NTLM capture, BloodHound,
and Group Policy abuse
- Clear technical reporting that connects each observation to the next decision
## Repository structure
Each completed machine has its own directory and a GitHub-rendered `README.md`. Addresses,
credentials, and commands shown in the reports belong to isolated training environments and
should not be reused outside an authorized scope.
## Responsible use
These writeups explain offensive-security techniques so defenders and practitioners can
understand the underlying failures. Do not apply the techniques to systems you do not own or
have explicit permission to test.