Offensive Security
Notes & Walkthroughs
Detailed writeups for Hack The Box machines, Pro Labs, APT Labs, Endgames, pwnable.tw challenges, and CTF competitions. Focused on Active Directory, binary exploitation, malware development, and red team operations.
High school student from Vietnam passionate about offensive security, binary exploitation, and Active Directory attacks.
SOC Analyst Roadmap: Zero to L3 Senior
A real battle map from Newbie to Senior L3 — four stages, every skill, every specific hit. Wireshark, Splunk, Elastic, MITRE ATT&CK, Volatility3, YARA, Sigma, Python automation, SOAR playbook. No dry theory — hands-on labs and real investigation walkthroughs.
H1 2026 Supply Chain Threat Report — Top 3 Incidents
Deep technical analysis of Stryker/Handala Wiper (Intune weaponization, 200K+ devices), Match Group/ShinyHunters (Okta SSO vishing, 10M+ records), and Citizens & Frost Bank/Everest (shared vendor compromise, 3.65M+ records). Attack chain reconstruction, TTP analysis, IoCs, and strategic forecast.
DirtyDecrypt / DirtyCBC — CVE-2026-31635
Local privilege escalation to root via rxgk_decrypt_skb — a missing COW guard vulnerability in the Linux kernel rxgk module that allows bypassing Copy-On-Write protection and writing directly into the page cache. Deterministic exploit, no race condition, public PoC available.
ShadowPolicy — GPO Preference State-Injection
Advanced detection and auditing framework for the ShadowPolicy threat model: GPO Preference Scheduled Task XML injection via SYSVOL state modification in Windows Server 2022 / Active Directory. Full defensive architecture with DSC hardening, SACL auditing, and SIEM detection rules.
Basic Shellcode Injection — Windows API Fundamentals
Introduction to malware development on Windows. Understanding the VirtualAlloc → WriteProcessMemory → CreateThread execution flow, generating position-independent shellcode, and injecting it into a remote process.
Driver's Shadow — Unmasking the Kernel Intruder
Linux memory forensics deep dive with Volatility3. Hunting a kernel rootkit that uses ftrace hooks for syscall interception, XOR-obfuscated payloads, udev persistence, and covert IPC via the kill syscall. Full chain from ISF generation to kernel module extraction and reverse engineering.
HTB Endgame: XEN
Complete domain compromise through Citrix VDI breakout, Kerberoasting, NetScaler PCAP analysis, password spraying, and SeBackupPrivilege abuse to extract ntds.dit from the Domain Controller. Six flags across the entire kill chain.
HTB Pro Lab: Dante
Red Team Operator Level I lab walkthrough. Pivoting through 14 machines across three subnets using Ligolo-ng, WordPress exploitation, LLMNR poisoning, buffer overflows, and KeePass credential extraction to achieve domain dominance.
HTB Pro Lab: Zephyr
Red Team Operator Level I. Assumed breach Active Directory environment starting with a standard domain user. Escalate through Kerberoasting, delegation abuse, constrained delegation, ACL attacks, and DCSync to achieve full Domain Admin compromise.
HTB Pro Lab: Offshore
Red Team Operator Level II. Advanced corporate network penetration testing requiring deep pivoting across multiple subnets, exploiting web vulnerabilities, Grafana exploitation, complex privilege escalation paths, and tunneling deep into the internal AD environment.
HTB Pro Lab: Cybernetics
Red Team Operator Level II. Advanced Active Directory attacks across five domains including Kerberos delegation abuse, GPO exploitation, forest trust pivoting, and cross-domain compromise with 25 flags.
HTB Pro Lab: RastaLabs
Red Team Operator Level III. The most advanced HTB Pro Lab featuring realistic APT-style operations — Cobalt Strike C2 infrastructure, Citrix VDI exploitation, network pivoting through multiple trust boundaries, and full enterprise domain takeover with 30+ flags.
HTB Pro Lab: APTLabs
Advanced Persistent Threat simulation environment. 18 machines across 3 AD forests — phishing initial access, Kerberoasting, RBCD, DCSync, Golden Tickets, cross-forest trust exploitation, and full domain compromise. 20 flags, 24h daily reset.
DarkCorp
Full Active Directory chain attack including NTLM relay, GPO abuse, Silver Ticket forgery, and Shadow Credential exploitation on a hardened Windows domain environment.
Sorcery
Docker escape through Kafka RCE combined with SSRF chain exploitation, leading to FreeIPA domain compromise through container breakout and privilege escalation.
Brainfuck
WordPress exploitation combined with RSA cryptographic attacks. From web application foothold through custom cipher decryption to root access on a hardened Linux system.
APT
Advanced persistent threat simulation on a Windows Domain Controller. NTLMv1 downgrade attacks, DC exploitation, and multi-stage privilege escalation in a hardened AD environment.
Rope
Binary exploitation through format string vulnerability to ROP chain construction. Stack-based buffer overflow with custom exploit development on a 64-bit Linux binary.
RopeTwo
V8 engine out-of-bounds exploitation leading to browser sandbox escape and kernel-level privilege escalation. Advanced pwn chain from JavaScript engine to root on Linux.
APTNightmare2
Memory forensics investigation of an APT intrusion. Rootkit analysis, process reconstruction, and indicator extraction from a compromised Windows memory dump.
SalineBreeze-1
Threat intelligence deep dive into Salt Typhoon's network-device espionage toolkit and GhostEmperor's kernel-mode Demodex rootkit. MITRE ATT&CK mapping, CVE analysis, and APT profiling.
Digimon
Multi-vulnerability exploitation: seccomp bypass via openat, libtcc code compilation, negative index OOB, null byte off-by-one, and game automation.
CriticalHeap++
Advanced heap exploitation with system/clock/normal heap types — format string via TZ environment variable and heap metadata corruption.
Unexploitable
Full protections + seccomp — Fork-based canary brute-force, PIE/libc leak via write-back, SROP ORW chain.
Stupid Boss
C++ type confusion in a game simulation — exploiting irrational type conversions between L_Java and L_Javascript to leak addresses and overwrite __free_hook.
Seccomp Tools
Understanding and bypassing seccomp-BPF filters — when open and openat are blocked, openat2 saves the day.
OmegaGo
Go binary exploitation — race condition and heap corruption in a concurrent Go game server with interface itab hijack.
Food Store
HITCON 2020 — Heap UAF + seccomp sandbox escape via tcache poisoning and ORW ROP chain with setcontext stack pivot.
De-ASLR
Defeating ASLR with a single GOT overwrite — exploiting the gets/system offset trick on a minimal x86-64 binary.
Bounty Beta
Format string vulnerability in a bounty management system — leaking libc via stack offsets and GOT overwrite with %hn split-writes.
Bash Revenge
Shellshock strikes back — bypassing the initial CVE-2014-6271 patch with CVE-2014-6278 using the BASH_FUNC_ internal format.
Baby Allocator
Custom heap allocator exploitation — corrupting allocator metadata to hijack free list and achieve arbitrary write via __free_hook.
Ghost Party
C++ Vtable Hijack via Use-After-Free — Ghost object lifecycle exploitation on glibc 2.23.
Break Out
Prison management system — UAF + House of Orange for code execution without free().
WannaHeap
Advanced heap exploitation — Null byte arbitrary write in libc via _IO_2_1_stdin_ manipulation and setcontext ORW.
Tcache Tear
Tcache double-free exploitation on glibc 2.27 — poisoning tcache linked list for arbitrary allocation.
Stupid Robot
C++ type confusion — Boss A's substring check enables reinterpret_cast abuse for arbitrary write.
Secret of My Heart
Heap + Format String — glibc 2.23 mmap-based heap exploitation with __free_hook overwrite.
Printable
Format string exploitation with a printable-only input constraint — when you can only type ASCII 0x20–0x7E.
MnO2
Manganese Dioxide — Advanced heap exploitation with constrained operations on glibc 2.27.
Kidding
CVE-2018-1160 — Netatalk AFP server heap overflow with ASLR brute-force oracle and _rtld_global overwrite.
HITCON FTP
Custom TFTP server with msgpack serialization — seccomp sandbox bypass via msgpack deserialization bug.
Bookwriter
Heap exploitation with Use-After-Free in a book management application on glibc 2.23.
Re-alloc Revenge
Realloc UAF + Tcache Double-Free Bypass — Size-shift trick to poison tcache on glibc 2.29.
Heap Paradise
Advanced Heap Exploitation — Multiple heap primitives with overlapping chunks on glibc 2.27.
Caov
Heap UAF via Stack-Reuse — C++ Data class exploitation with fastbin attack on glibc 2.23.
Starbound
Heap exploitation with Use-After-Free on glibc 2.23 — corrupting fastbin freelist for arbitrary allocation.
Spirited Away
Heap Use-After-Free exploitation in a survey application — leveraging dangling pointers for information leak and code execution.
Secret Garden
Heap UAF exploitation in a garden management program — fastbin attack with double-free on glibc 2.23.
Bounty Alpha
Heap Use-After-Free exploitation on glibc 2.23 — dangling pointer abuse for libc leak and shell.
BabyStack
Stack buffer overflow with canary leak — bypassing stack protection through information disclosure and ROP chain.
Alive Note
Heap UAF with function pointer hijack in a note-taking application on glibc 2.23.
See the File
File operation exploitation — leveraging FILE structure and libc leak for GOT overwrite.
Death Note
Heap exploitation with Use-After-Free in a death note application on glibc 2.23.
CVE-2018-10387
1-Day Exploitation — OpenTFTP SP 1.64 heap overflow leading to RCE.
Silver Bullet
strncat null-byte off-by-one leading to stack BOF and ROP chain execution.
Re-alloc
Heap UAF via realloc misuse — tcache poisoning and GOT overwrite on x86-64.
Hacknote
Use-After-Free in a note manager — exploiting dangling function pointer with system() via GOT leak.
Dubblesort
Stack buffer overflow in a sorting program — libc leak via format string and ROP chain for shell.
CriticalHeap
Heap exploitation with Use-After-Free on glibc 2.23 — introductory heap challenge.
Bash
You have the shell, and then? — Privilege escalation via Shellshock on a vulnerable SUID bash binary.
Apple Store
Heap exploitation in a shopping cart application — Use-After-Free on glibc 2.23.
Calc
Calculator logic bug — Expression parser allows arbitrary stack read/write via +N+M format, ROP for shell.
3x17
Write-what-where — Arbitrary 18-byte write primitive, .fini_array hijack for infinite loop, ROP chain in writable memory.
Start
Just a start — Stack BOF with shellcode execution on a minimal i386 binary. No protections, stack leak via write() gadget.
ORW
Open-Read-Write — Shellcode with seccomp sandbox, only open/read/write syscalls allowed.
CVE-2018-1160
1-Day — Netatalk AppleDouble OOB write, DSI function pointer hijack, pre-auth RCE.
Opening Night
XXE injection through SVG file upload. Exploiting XML external entity processing in a web application's image upload functionality to read arbitrary server files.
Free Cloud Storage
Zip Slip directory traversal attack through a file upload service. Crafting a malicious ZIP archive with path traversal symlinks to write files outside the intended directory.
Trust Issues
DNSSEC validation bypass combined with SQL injection. Chaining cryptographic protocol weaknesses with database exploitation to bypass authentication mechanisms.
Bit Leak
RSA partial key exposure attack using LSB oracle. Recovering full plaintext from an RSA encryption oracle that leaks individual bits through a padding oracle side-channel.
3-Write-Up
VoIP packet analysis and PNG reconstruction from network capture data. Extracting hidden voice communications and embedded image files from PCAP traffic.
Invisible Ink
Polyglot file analysis combining PDF and alternate format parsing. Extracting hidden data layers from a document that serves as both a valid PDF and another file format.
Loud Packets
Bitmap image reconstruction and steganographic analysis. Decoding hidden information embedded in packet payload data mapped to bitmap pixel values.
Thomas Schools of China
Reverse engineering a custom binary file format. Parsing proprietary headers, custom compression schemes, and non-standard encoding to extract the hidden flag data.
Polaroid
Mach-O binary reverse engineering on macOS. XOR-based string obfuscation analysis, Objective-C method tracing, and flag extraction from a native Apple binary.
Remoose
ELF binary analysis with anti-debugging techniques. Bypassing ptrace-based protections, reconstructing obfuscated control flow, and extracting the flag from a hardened Linux executable.
Hunting Field
Buffer underflow exploitation on a Linux binary. Unconventional memory corruption through negative indexing, hijacking execution flow via stack manipulation and GOT overwrite.
Glitch
Image steganography challenge. Extracting hidden data from visual artifacts in a glitched image file through pixel-level analysis and channel manipulation.
Calculative Barracuda
AI prompt injection and jailbreaking challenge. Manipulating LLM behavior through carefully crafted inputs to bypass safety filters and extract restricted information.
Crocc Crew
Full Active Directory attack chain from web enumeration through SMB and LDAP enumeration, Kerberoasting, Constrained Delegation abuse, and Secrets Dump to achieve Domain Admin on a TryHackMe AD lab.
CCT 2019
Cyber Competition Team 2019 challenges including Forensics, Reverse Engineering, PCAP analysis, and Cryptography. Multi-category CTF walkthrough with detailed analysis of each challenge.