Tryhackme

A TCP service hands you the AES-CBC ciphertext of your own input and asks you to return a ciphertext that decrypts to contain admin credentials — solved with a single-byte XOR flip.

A full-range nmap scan uncovers a port 31337 service broadcasting SSH credentials in plaintext — connecting the dots between -sV output and an SSH login to grab the flag.

Anonymous SMB leaks a default onboarding password; AS-REP roasting cracks TABATHA_BRITT; a three-link BloodHound ACL chain of forced password resets leads to DARLA_WINTERS, whose constrained delegation with protocol transition lets us impersonate Administrator via S4U2Self/S4U2Proxy for a full domain dump.

An exposed Spring Boot Actuator plus an nginx /.;/ path-ACL bypass leaks admin creds and the first flag; an HTTP/2 H2.CL desync then captures an internal bot’s request, stealing its flag cookie.

A vulnerable nginx server exposes OpenSSL’s Heartbleed bug (CVE-2014-0160), allowing unauthenticated heap memory disclosure that leaks a plaintext HTTP POST body — and the flag — straight out of an active SSL session.

A padel-tournament portal behind a deny-list ModSecurity WAF falls to a three-step chain: a User-Agent header bypass, a stored XSS that steals a moderator bot’s session cookie, and an LFI that leaks admin creds via full per-character URL-encoding.

SSRF via a pycurl download endpoint chains into file:// LFI, Werkzeug debug PIN cracking, and full RCE on a Dockerised Flask app.

XSS in a registration form exfiltrates the admin’s session cookie; RFI via the admin URL-tester gives www-data code execution; double-MD5 cracking yields SSH access, and a sudo apache2 logging trick writes a root SSH key.