// SYSTEM_INFO — READ BEFORE PROCEEDING
Welcome to m4rthacks — a personal archive of CTF writeups, hacking notes, tools, and tips & tricks.
You'll find detailed walkthroughs of Capture The Flag challenges across categories like web exploitation, binary exploitation, cryptography, reverse engineering, forensics, and OSINT. Each writeup breaks down the thought process, the tools used, and the steps taken to get the flag.
Feel free to explore, learn, and hack responsibly.
WRITEUPS: 98
Hack The Box - Helix (Linux)
We find a hidden virtual host flow.helix.htb that runs Apache NiFi 1.21.0, which is vulnerable to CVE-2023-34468. We exploit this vulnerability to get a reverse shell as the user operator. We find the operator's SSH private key and use it to SSH into the target machine. We find that we can run the program helix-maint-console as root, but it requires a privileged maintenance window to be open. We find an OPC UA port that allows us to change some values in the plant, which opens the privileged maintenance window, allowing us to run helix-maint-console and get a root shell.
Hack The Box - Kobold (Linux)
We exploit a remote code execution vulnerability in MCPJam (CVE-2026-23744), getting an initial foothold as the user ben. We write a malicious php script in a PrivateBin folder and include it via the template cookie (CVE-2025-64714), getting a reverse shell in a docker container. The application config file exposes a hardcoded password. We use that password to access the Arcane Docker management portal on port 3552, where we create a new container with root privileges, allowing us to read the host file system and retrieve the root flag.
RINg the Bell (pwn)
Exploit a buffer overflow vulnerability to call the `bell` function and spawn a shell.
The Corroded Crown (pwn)
Exploit a use-after-free vulnerability to leak a libc address, then perform tcache poisoning to overwrite __malloc_hook with the address of a shellcode on the stack, and finally execute the shellcode to get a shell.
The Emptiness Machine (pwn)
Exploit a file stream oriented programming (FSOP) vulnerability to execute system.
The Hinge Whisper (pwn)
Exploit a buffer overflow vulnerability to inject shellcode into the stack and execute it.
Words from the Past (pwn)
After patching out the debugger check, we discover an RWX memory region that directly executes a five-byte payload. We first send a relative CALL instruction to loop back to main, triggering a second stage that maps executable memory right next to libc. Using a relative JMP instruction, we target a one_gadget inside libc to hijack execution flow and spawn a shell. Because the target memory address depends on the child process ID, we brute-force the eight possible PID offsets to reliably gain full control.
Hack The Box - Fries (Windows)
We start with supplied credentials that are valid only for the web applications. A misconfigured PWM instance and exposed Gitea repository lead to PostgreSQL command execution and a foothold inside the Docker environment. Abuse of the Docker TLS API yields root access to the Linux host, allowing recovery of the PWM configuration and Active Directory service account credentials. Finally, certipy reveals an AD CS misconfiguration that can be exploited through ESC6/ESC7 to obtain Domain Administrator privileges.
Hack The Box - Logging (Windows)
We start with credentials for the user `wallace.everette`. We enumerate the machine and find a log file that contains the credentials for the user `svc_recovery`. We use those credentials to perform a shadow credentials attack on the machine account `msa_health$` to get its nthash. We use that to get a shell on the machine. We abuse a DLL hijacking vulnerability in the UpdateMonitor program to become another user. Finally, we abuse a WSUS client that connects to `wsus.logging.htb` to run commands as admin.
Hack The Box - CCTV (Linux)
ZoneMinder time-based SQL injection reveals mark credentials. After SSH login, we find the MotionEye configuration files with the admin password. Finally, a MotionEye RCE vulnerability leads to root.
Hack The Box — DevArea (Linux)
Anonymous FTP and Apache CXF SSRF expose secrets that unlock Hoverfly RCE. A leaked config file yields the Flask secret and admin credentials. Session forgery opens the syswatch dashboard as admin. A command injection flaw then grants code execution as syswatch. From there, symlink abuse in syswatch leads to root compromise.
Hack The Box — WingData (Linux)
CVE-2025-47812 in Wing FTP Server v7.4.3 allows to get a reverse shell as wingftp. Some user data are contained in XML files and we can crack the password of user wacky and login via SSH. User wacky can run a Python script with sudo privileges. The script uses the tar package and `tar.extractall()`. CVE-2025-4517 allows to modify existing files, so we can modify /etc/passwd to add a root user.