TryHackMe on Th3B0yWh0L1v3d — Security Writeups

TryHackMe on Th3B0yWh0L1v3d — Security Writeups https://th3b0ywh0l1v3d.github.io/thm/ Recent content in TryHackMe on Th3B0yWh0L1v3d — Security Writeups Hugo en-us Tue, 09 Jun 2026 00:00:00 +0000 Flip Dat Bit — TryHackMe https://th3b0ywh0l1v3d.github.io/thm/flip-dat-bit/ Tue, 09 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/thm/flip-dat-bit/ A TCP service hands you the AES-CBC ciphertext of your own input and asks you to return a ciphertext that decrypts to contain admin credentials — solved with a single-byte XOR flip. Intermediate Nmap — TryHackMe https://th3b0ywh0l1v3d.github.io/thm/intermediate-nmap/ Tue, 09 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/thm/intermediate-nmap/ A full-range nmap scan uncovers a port 31337 service broadcasting SSH credentials in plaintext — connecting the dots between -sV output and an SSH login to grab the flag. Reset — TryHackMe https://th3b0ywh0l1v3d.github.io/thm/reset/ Tue, 09 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/thm/reset/ Anonymous SMB leaks a default onboarding password; AS-REP roasting cracks TABATHA_BRITT; a three-link BloodHound ACL chain of forced password resets leads to DARLA_WINTERS, whose constrained delegation with protocol transition lets us impersonate Administrator via S4U2Self/S4U2Proxy for a full domain dump. El Bandito — TryHackMe https://th3b0ywh0l1v3d.github.io/thm/el-bandito/ Mon, 08 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/thm/el-bandito/ An exposed Spring Boot Actuator plus an nginx /.;/ path-ACL bypass leaks admin creds and the first flag; an HTTP/2 H2.CL desync then captures an internal bot’s request, stealing its flag cookie. HeartBleed — TryHackMe https://th3b0ywh0l1v3d.github.io/thm/heartbleed/ Mon, 08 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/thm/heartbleed/ A vulnerable nginx server exposes OpenSSL’s Heartbleed bug (CVE-2014-0160), allowing unauthenticated heap memory disclosure that leaks a plaintext HTTP POST body — and the flag — straight out of an active SSL session. Padelify — TryHackMe https://th3b0ywh0l1v3d.github.io/thm/padelify/ Mon, 08 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/thm/padelify/ A padel-tournament portal behind a deny-list ModSecurity WAF falls to a three-step chain: a User-Agent header bypass, a stored XSS that steals a moderator bot’s session cookie, and an LFI that leaks admin creds via full per-character URL-encoding. Plant Photographer — TryHackMe https://th3b0ywh0l1v3d.github.io/thm/plant-photographer/ Mon, 08 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/thm/plant-photographer/ SSRF via a pycurl download endpoint chains into file:// LFI, Werkzeug debug PIN cracking, and full RCE on a Dockerised Flask app. Robots — TryHackMe https://th3b0ywh0l1v3d.github.io/thm/robots/ Mon, 08 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/thm/robots/ XSS in a registration form exfiltrates the admin’s session cookie; RFI via the admin URL-tester gives www-data code execution; double-MD5 cracking yields SSH access, and a sudo apache2 logging trick writes a root SSH key.