th3_m4d_h4ck3r

A Windows Server 2025 domain controller rooted through ADCS: a low-priv user revives deleted-but-still-published certificate templates (ESC3), then beats Full strong-binding by forging a cert for the DC machine account — PKINIT to DCSync to Domain Admin.

Full Active Directory domain compromise: anonymous LDAP enumeration into AS-REP Roasting, then nested-group and WriteDACL abuse to self-grant DCSync rights and Pass-the-Hash as Administrator.

A Linux box built entirely around hand-rolled legacy printer protocols. Chains an LPD shell injection into a JetDirect path traversal for SSH key injection, then abuses a forensic honeypot's SCM_RIGHTS FD leak to reach root.

A Next.js dashboard owned through a framework-level bug: unauthenticated RCE via CVE-2025-55182 ("React2Shell"), then SQLite credential theft and an MD5 crack, escalating to root by abusing a debug-mode Node.js process over the Chrome DevTools Protocol.

A chain of corporate misconfigurations: an unauthenticated NFS share leaks onboarding creds, password reuse opens an OpenSTAManager CRM, and an authenticated file-upload RCE (CVE-2026-38751) lands a foothold — escalating to root via a shell-injectable OliveTin action running unauthenticated on localhost.

A leaked DB password buried in Gitea commit history and a Krayin CRM file-upload RCE (CVE-2026-38526) chain into a foothold — then root falls to a hand-crafted git tree object smuggling a path-traversal filename past a root-run template sync script.

An unauthenticated Craft CMS preauth RCE (CVE-2025-32432) via a Yii2 behavior gadget and access-log poisoning lands a foothold, then a cracked admin hash opens SSH — and root falls to a telnetd argument-injection auth bypass (CVE-2026-24061) where a crafted USER value becomes login -f root.

A password-reset endpoint hands back the new password in its response, opening a log-viewer LFI that's poisoned via the User-Agent for RCE — then legacy rservices trust (hosts.equiv) and a sudo nano GTFOBins escape chain all the way to root.

A MariaDB instance exposed on its default port with unauthenticated root access — no exploit chain, just SQL enumeration. A clean refresher on hunting an application database, with an information_schema cheatsheet for locating a target column across an unfamiliar schema fast.

A Windows XAMPP host with an LFI in a page parameter is pivoted from file disclosure into NTLM coercion — feeding include() a UNC path forces the box to authenticate to a Responder listener, leaking an Administrator hash that cracks to a weak password and opens a WinRM shell via Evil-WinRM.

Virtual-host fuzzing surfaces a hidden s3 subdomain backing the site from a publicly writable, misconfigured S3 bucket that doubles as the Apache web root — so uploading a PHP web shell with anonymous AWS creds is instant RCE as www-data, escalated to a reverse shell and the flag.