https://0x4p0ll0.me/Security writeups, CTF walkthroughs, and the notes I take along the way.enhttps://0x4p0ll0.me/posts/craft.htmlhttps://0x4p0ll0.me/posts/craft.htmlSat, 05 Sep 2026 00:00:00 +0000MachinesA public API repo on a Gogs server leaks an unsanitised eval() in the brew-ABV check, and a second commit leaks the API creds needed to reach it, so a JSON field turns into RCE inside a Docker container. DB creds from settings.py dump the user table, Gilfoyle reused his password on Gogs, and the same password again decrypts an SSH key from a private repo. His .vault-token is scoped to a HashiCorp Vault root_otp SSH role, so vault ssh just hands me a one-time root password.https://0x4p0ll0.me/posts/trick.htmlhttps://0x4p0ll0.me/posts/trick.htmlSat, 05 Sep 2026 00:00:00 +0000MachinesA DNS zone transfer leaks a preprod payroll vhost with a SQL injection that hands me file-read on the box. The nginx config points at a second vhost carrying a path-traversal LFI that leaks michael's SSH key, and a sudo-able fail2ban restart plus write access to action.d turns a ban action into a root shell.https://0x4p0ll0.me/posts/editorial.htmlhttps://0x4p0ll0.me/posts/editorial.htmlFri, 04 Sep 2026 00:00:00 +0000MachinesAn SSRF in a book-cover upload form leaks an internal API and dev creds; deleted-but-not-forgotten git history hands over prod creds, and a GitPython ext:: protocol bug (CVE-2022-24439) finishes the job as root.https://0x4p0ll0.me/posts/pilgrimage.htmlhttps://0x4p0ll0.me/posts/pilgrimage.htmlFri, 04 Sep 2026 00:00:00 +0000MachinesAn arbitrary file read in a bundled ImageMagick binary (CVE-2022-44268) leaks the site's SQLite database and a user's password, and a root-owned malware-scanning script running a vulnerable binwalk (CVE-2022-4510) is abused for a path-traversal write that plants a reverse shell as root.https://0x4p0ll0.me/posts/inject.htmlhttps://0x4p0ll0.me/posts/inject.htmlSat, 22 Aug 2026 00:00:00 +0000MachinesAn LFI in an image viewer leaks source and a vulnerable Spring Cloud Function dependency (CVE-2022-22963); a cron-run Ansible play then hands over root.https://0x4p0ll0.me/posts/updown.htmlhttps://0x4p0ll0.me/posts/updown.htmlSun, 16 Aug 2026 00:00:00 +0000MachinesAn exposed .git repo reveals a dev vhost; a PHP LFI plus the phar:// wrapper gives RCE, then a SUID Python app and a sudo easy_install reach root.https://0x4p0ll0.me/posts/headless.htmlhttps://0x4p0ll0.me/posts/headless.htmlFri, 14 Aug 2026 00:00:00 +0000MachinesStored XSS in a request header steals an admin cookie, a command injection in the admin dashboard lands a shell, and a sudo maintenance script gives root.https://0x4p0ll0.me/posts/hospital.htmlhttps://0x4p0ll0.me/posts/hospital.htmlWed, 12 Aug 2026 00:00:00 +0000MachinesA PHP upload filter bypass drops a webshell, a GhostScript RCE (CVE-2023-36664) and a cracked hash move laterally, and a writable service path reaches SYSTEM.https://0x4p0ll0.me/posts/mustacchio.htmlhttps://0x4p0ll0.me/posts/mustacchio.htmlMon, 10 Aug 2026 00:00:00 +0000MachinesAn exposed SQLite backup leaks an admin hash, an XXE in a hidden panel exfiltrates an SSH key, and PATH hijacking on a SUID binary escalates to root.https://0x4p0ll0.me/posts/lame.htmlhttps://0x4p0ll0.me/posts/lame.htmlSat, 08 Aug 2026 00:00:00 +0000MachinesA classic box: a vulnerable Samba username-map script (CVE-2007-2447) gives an unauthenticated root shell in a single request.https://0x4p0ll0.me/posts/goldeneye.htmlhttps://0x4p0ll0.me/posts/goldeneye.htmlTue, 04 Aug 2026 00:00:00 +0000MachinesCredential reuse and mailbox enumeration expose a Moodle admin login; a Moodle spell-check RCE lands a shell, and an outdated kernel gets root.