• Take advantage of the RCE vulnerability to get a netcat connection and gain a shell on the box.
  • Enumerate running services on the box and find an application vulnerable to buffer overflow with existing exploit/POC.
  • Convert…


  • Use cewl to create wordlist and brute-force to gain access to admin page.
  • Use public exploit code to land a shell on the box.
  • Get to “hugo” user by cracking discovered password hash.
  • Get root via sudo bug (CVE 2019–14287).


Traceback was a fun and exciting challenge box. A unique way to get root and as always, I learnt new things while attempting the challenge.


  • Login to attackers’ web shells
  • Upload and execute php reverse shell

Magic was a medium rated machine and also the first box I successfully attempted. Big thanks to @Rainsec_ for helping me out when I was stuck.


  • Add jpeg magic bytes to a reverse shell and upload it.
  • Use mysqldump to retrieve the password…


CTF | All things Security😉

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store