resux_

Every machine I've pwned.

Full chain, first packet to root. Not just the flag.

10 machines 1 AD chain 4 sealed OSCP in progress

Method

Match what's on your screen.

A decision graph for the moment you have a shell and no idea what to do with it. It starts from real output. You pick the line that looks like yours, and every step ends at the file where I used it.

Open the method →

Recent files

Latest

Six most recent. All files →

FILE 010 · Privilege escalation OPEN

Nexus

A password scrubbed from .env survives in Gitea's commit history, Krayin's email composer stores an attachment the web server will execute, and a root sync timer trusts filenames that come out of a git tree.

  • credential in Gitea commit history
  • Krayin attachment upload
  • password reuse to SSH
  • crafted git tree path traversal
  • SUID bash via /etc/cron.d
FILE 003 · Initial access OPEN

Barrier

A credential in a public repo becomes GitLab admin via a SAML signature-wrapping bug, CI/CD variables hand back the IdP token, and Guacamole stores its backend credentials in cleartext. Root was typed into bash history.

  • leaked repo credential
  • CVE-2024-45409 SAML XSW
  • admin PAT to CI/CD variables
  • authentik set_password
  • Guacamole stored creds
  • bash history password
FILE 004 · Initial access OPEN

CCTV

ZoneMinder 1.37.63 gives up bcrypt hashes to a blind SQLi, and its auth secret was never changed, so I forge a superadmin session instead of cracking. Root is Motion's unauth config API running $(...) as a filename.

  • ZoneMinder default creds
  • CVE-2024-51482 blind SQLi
  • forged legacy auth hash
  • monitor Device injection
  • Motion config injection
FILE 005 · Initial access SEALED

DevHub

Sealed while the box is active. Encrypted, and it stays that way.

  • sealed
FILE 006 · Privilege escalation SEALED

Helix

Sealed while the box is active. Encrypted, and it stays that way.

  • sealed
FILE 007 · Lateral / AD OPEN

Overwatch

A guest-readable SMB share hands over a .NET binary with SQL credentials in it, a stale linked server plus a DNS record I add myself relays auth to me, and a WCF service concatenates its input into PowerShell as SYSTEM.

  • .NET decompile
  • hardcoded SQL creds
  • linked server DNS poisoning
  • NTLM capture
  • WCF command injection