HackTheBox

HTB Bounty: File Upload to System via Chimichurri

IIS file upload bypass via web.config for initial shell on Windows, then SYSTEM access using the Chimichurri (MS10-059) kernel exploit.

AI Security

I Asked an AI About Its Security Policies: It Gave Me the API Key

A simple prompt about security policies tricked an AI chatbot into leaking its API key. Real-world case study on AI deployment security failures.

AI Security

Breaking an AI-Powered Shell

Red teaming an AI-powered shell application — prompt injection, command injection, and sandbox escape techniques against LLM-integrated CLI tools.

CTF Writeups

HTB Blocky

Minecraft server enumeration, Java JAR plugin decompilation revealing hardcoded database credentials, and trivial root access via sudo su.

CTF Writeups

HTB Keeper Writeup: How a Danish Dessert Unlocked Root Access

Request Tracker default credentials for initial access, then KeePass crash dump memory analysis (CVE-2023-32784) to extract the root SSH key.

CTF Writeups

HTB Knife: PHP 8.1.0-dev Supply Chain Backdoor RCE to Root

Exploiting the PHP 8.1.0-dev supply chain backdoor via User-Agentt header for RCE, then root through knife binary sudo privilege on Linux.