13 writeups
A KAPE triage image of an abandoned laptop yields one saved Chrome password, decrypted entirely offline through a DPAPI masterkey → Local State → AES-GCM chain, which turns out to be the passphrase for a hidden VeraCrypt volume holding the real evidence.
Persistence hiding outside every autoruns tool's coverage — a malicious WMI class buried in the raw CIM repository carries a compressed .NET payload that only detonates on the domain controller by name.
The same unsanitised shell=True command injection shows up twice on this box — first as a low-priv foothold via a "connectivity check" tool, then again in a root-owned automation service reached by pivoting through internal-only FreePBX and Chisel tunnels.
A zip-slip flaw in a staff upload feature lets an extracted archive entry escape its per-upload folder and overwrite the app's own live Jinja template, turning a simple file upload into persistent SSTI/RCE.
An Azure static website leaks an over-scoped account SAS token, which exposes a hidden storage container holding service-principal credentials — and from there, a Key Vault secret whose "rotated" value is still recoverable in its previous version.
A crypto rewards app rate-limits its daily claim to once per 24h, but the check-then-act isn't atomic — firing 30 parallel requests with Burp's last-byte sync lets every one of them win the race.
A NoSQL injection auth bypass leads to an EJS SSTI RCE, then an exposed Node --inspect debugger and disk-group membership chain all the way to a raw block-device read of root.txt.
A screenshotted chat reveals an email address and a hint about a "free profile linker starting with G" — hashing the email for Gravatar and pulling its JSON profile surfaces a hidden bio with the flag.
Demo creds in an HTML comment lead to an unsafe YAML deserialization RCE in a playlist importer, then a root password exposed in plain process arguments gets reused directly for su root.
A PCAP shows a covert channel exfiltrating one byte per HTTP request inside a Cookie header — base64 plus a single-byte XOR, broken instantly with a known-plaintext crib on the flag format.
A "free" wellness app hands out unauthenticated Cognito guest credentials, and an over-scoped IAM role lets those guest credentials Scan the entire DynamoDB table instead of just one record.
A Flask app leaves .git/ reachable — git-dumper reconstructs the full repo, and a "remove before launch" note in the staging README hands over the flag directly.
An LLM hotel concierge gates its system prompt behind guest "trust" rather than real auth — claiming a recognized name plus asking it to reveal its instructions dumps the whole prompt, escalation code included.