CTF writeups, HackTheBox notes, and security work.https://404gh0st.my.id/https://404gh0st.my.id/blog/bitsctf/https://404gh0st.my.id/blog/bitsctf/Writeup for BITSCTF 2026Sun, 22 Feb 2026 00:00:00 GMThttps://404gh0st.my.id/blog/fluffy/https://404gh0st.my.id/blog/fluffy/Fluffy is an easy Windows machine that demonstrates CVE-2025-24071, Shadow Credentials technique, and ESC16 vulnerability on ADCS.Sat, 31 May 2025 00:00:00 GMThttps://404gh0st.my.id/blog/nocturnal/https://404gh0st.my.id/blog/nocturnal/Nocturnal is an easy Linux machine that demonstrates command injection bypass and privilege escalation using CVE-2023-46818.Sat, 31 May 2025 00:00:00 GMThttps://404gh0st.my.id/blog/planning/https://404gh0st.my.id/blog/planning/Planning is an easy Linux machine that demonstrates CVE-2024-9264 to get initial access and using crontab-ui to escalate privilege.Sat, 31 May 2025 00:00:00 GMThttps://404gh0st.my.id/blog/puppy/https://404gh0st.my.id/blog/puppy/Puppy is a medium Windows machine. This is a grey box machine with a supplied credential. With the credential, we can take advantage of GenericWrite to get access to specific shares. Then, we found a KeePass database file that contains a valid credential for another user account. This user account has GenericAll to another user account that belongs to the Remote Management Users group. There will be a backup file that contains another credential inside the machine. Using the credential, we found a saved credential in the DPAPI that contains a credential for administrative user account.Fri, 30 May 2025 00:00:00 GMThttps://404gh0st.my.id/blog/environment/https://404gh0st.my.id/blog/environment/Environment is a Linux machine. The box involves exploiting a Laravel web application vulnerability (CVE-2024-52301) to bypass authentication and upload a shell. It involves finding and decrypting a GPG backup file to obtain credentials, and finally escalating privileges to root by abusing sudo permissions and the BASH_ENV variable.Sun, 04 May 2025 00:00:00 GMThttps://404gh0st.my.id/blog/haze/https://404gh0st.my.id/blog/haze/Haze is a challenging Active Directory machine characterized by a vulnerable Splunk installation and security configurations. The machine involves CVE-2024-36991, decrypting the Splunk secret, exploiting multiple ACL/ACE vulnerabilities, and abusing SeImpersonatePrivilege.Mon, 31 Mar 2025 00:00:00 GMThttps://404gh0st.my.id/blog/code/https://404gh0st.my.id/blog/code/Code is an easy Linux machine that demonstrates a Python Jail / Sandbox escape and privilege escalation from backy program.Sun, 23 Mar 2025 00:00:00 GMThttps://404gh0st.my.id/blog/thefrizz/https://404gh0st.my.id/blog/thefrizz/TheFrizz is a medium Windows machine. The box involves attacking a domain controller using Kerberos authentication, abusing Group Policy Objects (GPO), and leveraging the Recycle Bin. The attack path includes exploiting CVE-2023-45878 on Gibbon LMS, obtaining credentials, manipulating GPO settings, and finally achieving system access.Mon, 17 Mar 2025 00:00:00 GMThttps://404gh0st.my.id/blog/dog/https://404gh0st.my.id/blog/dog/Dog is an easy Linux machine that demonstrates exposed Git repository, vulnerable Backdrop CMS installation, and privilege escalation through Backdrop CMS bee utility program.Mon, 10 Mar 2025 00:00:00 GMThttps://404gh0st.my.id/blog/cypher/https://404gh0st.my.id/blog/cypher/Cypher is a medium-difficulty box that demonstrates Cypher injection, JAR file reversing, and privilege escalation through bbot.Sun, 02 Mar 2025 00:00:00 GMThttps://404gh0st.my.id/blog/checker/https://404gh0st.my.id/blog/checker/Checker is a challenging machine that demonstrates CVE-2023-1545 on Teampass, CVE-2023-6199 on BookStack, the use of Google Authenticator as SSH TOTP, and a race condition on shared memory for privilege escalation.Fri, 28 Feb 2025 00:00:00 GMThttps://404gh0st.my.id/blog/titanic/https://404gh0st.my.id/blog/titanic/Titanic is an easy Linux machine that demonstrates a basic Arbitrary File Read vulnerability, Gitea hash cracking, and exploitation of a vulnerable version of ImageMagick.Sat, 22 Feb 2025 00:00:00 GMThttps://404gh0st.my.id/blog/darkcorp/https://404gh0st.my.id/blog/darkcorp/Coming SoonSat, 15 Feb 2025 00:00:00 GMThttps://404gh0st.my.id/blog/vintage/https://404gh0st.my.id/blog/vintage/Vintage is a challenging Active Directory machine characterized by disabled NTLM authentication, enabled antivirus protection, and complex security configurations. The machine involves exploiting a Pre-2000 computer account, leveraging multiple ACL/ACE vulnerabilities, decrypting Data Protection API (DPAPI) secrets, and manipulating Resource-Based Constrained Delegation.Wed, 15 Jan 2025 00:00:00 GMT