CTF Writeups

Walkthroughs and notes from capture-the-flag challenges.

• Detecting Active Directory Attacks

  6 Nov, 2026

  CTF writeups for Detecting Active Directory Attacks, organized by challenge.

  CTF

• Operation Blackout — Hack The Box Sherlock Notes

  1 Dec, 2025

  Tracing virtualization checks through PowerShell event logs with Chainsaw.

  Hack The Box Sherlock

• EscapeTwo — Hack The Box Walkthrough

  11 Aug, 2025

  From an assumed-breach account and exposed spreadsheet credentials to WinRM, directory control, and an administrator hash.

  Hack The Box

• Brutus — Hack The Box Sherlock

  7 Mar, 2024

  Reconstructing an SSH brute force, root login, and persistence account from auth.log and wtmp.

  Hack The Box Sherlock

• Code — Hack The Box Walkthrough

  15 Oct, 2023

  Bypassing a Python editor's string filter, recovering an SSH credential, and using a privileged backup task to reach root's files.

  Hack The Box

• Forest — Hack The Box Walkthrough

  7 Aug, 2022

  A domain controller, AS-REP roasting, BloodHound, and a path to domain administrator.

  Hack The Box

• Investigating Windows — TryHackMe Walkthrough

  6 Aug, 2022

  Following Windows account, logon, startup, and process clues in a forensic lab.

  TryHackMe

• Remote Process Execution with Scheduled Tasks

  31 Jul, 2022

  A TryHackMe lab demonstration of creating, running, and removing a task on a remote Windows host.

  TryHackMe

• Netmon — Hack The Box Walkthrough

  21 Jul, 2022

  Anonymous FTP, a PRTG configuration backup, and authenticated command execution.

  Hack The Box

• Blue — Hack The Box Walkthrough

  13 Jul, 2022

  Identifying MS17-010 on an SMB service and confirming code execution on the Blue lab machine.

  Hack The Box

• Bastion — Hack The Box Walkthrough

  30 Jun, 2022

  Recovering Windows credentials from an exposed backup, then following an mRemoteNG connection file to administrator access.

  Hack The Box

• Heist — Hack The Box Walkthrough

  25 Jun, 2022

  Using a guest helpdesk page and Cisco configuration to reach a Windows account, then investigating a running browser.

  Hack The Box

• Stonks — picoCTF Format String Walkthrough

  4 Jun, 2022

  Reading a flag from process memory through an unsafe printf call.

  picoCTF

• LFI to RCE via Log Poisoning

  21 Feb, 2022

  How a TryHackMe Advent of Cyber lab turned a local file inclusion bug into PHP code execution through an application access log.

  TryHackMe

• Memory Forensics with Volatility — TryHackMe

  14 Feb, 2022

  Examining a Cridex memory image with Volatility's process, module, and extraction plugins.

  TryHackMe

• Horizontall — Hack The Box Walkthrough

  27 Jan, 2022

  Finding a Strapi API through frontend JavaScript, then reaching a local Laravel service.

  Hack The Box