Writeups
CTF writeups for TryHackMe, HackTheBox, Proving Grounds and more. Pick a platform to browse, filter and search.
Proving Grounds
110 writeups
Latest: Clue Writeup - Proving Grounds — Oct 8, 2026
HackTheBox
92 writeups · 31 locked
Latest: RedEye Writeup - HackTheBox — Nov 9, 2026
TryHackMe
10 writeups
Latest: Ice Writeup - TryHackMe — Sep 13, 2026
Latest writeups
Handler Writeup - HackTheBox
Clue Writeup - Proving Grounds
Intermediate Linux box where a null-auth SMB share and the Cassandra Web directory traversal (EDB-49362) leak a FreeSWITCH event socket password and a reused credential, chained into FreeSWITCH command execution (EDB-47799) and SSH, then a sudo rule that reruns Cassandra Web as root leads to an SSH key and root.
Law Writeup - Proving Grounds
Intermediate Linux box exploiting CVE-2022-35914 in an exposed htmLawed test page for a www-data shell, then escalating to root via a writable cron script.
Scrutiny Writeup - Proving Grounds
Intermediate Linux box fronting TeamCity behind an nginx vhost, exploited via the CVE-2024-27198 authentication bypass, then a cracked SSH key and a chain of mail-leaked credentials across three users ends in a sudo pager escape (CVE-2023-26604) for root.
BitForge Writeup - Proving Grounds
Intermediate Linux box where an exposed .git history leaks database credentials used to reset SOPlanning's admin hash, unlocking CVE-2024-27114 for a shell, then a leaky cron job and a writable sudo script give root.