Writeups from authorized OffSec labs, with more labs and CTFs to be added over time.
The reports are organized around reconnaissance, enumeration, initial access, and privilege escalation. Commands and payloads are included where they make the work reproducible, while flags and challenge answers are intentionally omitted.
All testing documented here was performed against systems I was explicitly authorized to assess. The material is shared for educational and portfolio purposes.
| Machine | Platform | Attack path |
|---|---|---|
| Brine | Linux | Exposed Git repository, unsafe pickle deserialization, leaked file descriptor, disk group abuse |
| Butch | Windows | Time-based SQL injection, unrestricted handler upload, code execution as SYSTEM |
| Covfefe | Linux | Exposed home directory, recovered SSH key, SUID buffer overflow |
| LazySysAdmin | Linux | Anonymous SMB access, WordPress compromise, password reuse, unrestricted sudo |
| Muddy | Linux | SOAP XXE, WebDAV upload, cron PATH hijacking |
| Scarecrow 1.1 | Linux | XXE file read, SSRF, command injection, SUID find |
| Sunset: Twilight | Linux | File upload bypass, local file inclusion, writable /etc/passwd |
| Vault | Windows / Active Directory | Forced authentication, NetNTLMv2 cracking, writable domain GPO |
- Network and service enumeration with RustScan, Nmap, SMB tooling, and content discovery
- Web exploitation involving SQL injection, XXE, SSRF, file inclusion, unsafe deserialization, stored XSS, and upload-filter bypasses
- Linux privilege escalation through SUID binaries, writable system files, cron path
manipulation, inherited file descriptors, and weak
sudopolicy - Windows and Active Directory exploitation through IIS, WinRM, NTLM capture, BloodHound, and Group Policy abuse
- Clear technical reporting that connects each observation to the next decision
Each completed machine has its own directory and a GitHub-rendered README.md. Addresses,
credentials, and commands shown in the reports belong to isolated training environments and
should not be reused outside an authorized scope.
These writeups explain offensive-security techniques so defenders and practitioners can understand the underlying failures. Do not apply the techniques to systems you do not own or have explicit permission to test.