Search for a command to run...
Overview CryptoCabana is a fake crypto-backup service hosted as an Azure Static Website. The attack path chains together four separate misconfigurations: A low-privilege Azure user with only Reader o
TL;DR Ponzi Portfolio is a Node.js/Express "staking rewards" web app with a 24-hour cooldown on claiming a reward. The /claim endpoint has a classic check-then-act race condition: it checks whether th
TL;DR Byte Lotus Poolside is a Node.js/Express booking app. A NoSQL injection in the login endpoint bypasses authentication entirely and lands directly in the staff role. The staff console's booking-c
TL;DR A single artifact - a zipped screenshot of a Discord-style DM conversation is the entire challenge. Two "Byte Lotus Hotel" guests, Ponzi and Lambo!, chat about social media; Lambo! name-drops a
TL;DR Beach Bar is a Flask-based "DJ booth" web app for a beach bar jukebox. Default demo credentials (dj/dj) left enabled in an HTML comment get you into the dashboard, which exposes a YAML playlist
TL;DR A .pcapng capture shows a victim host on 192.168.1.141 downloading a Python keylogger (updates.py) from an attacker-controlled "hotel update server" at byte-lotus-hotel.thm:8080 (34.41.103.191).
Summary Enterprise is an Active Directory box that starts as a classic external AD footprint (DNS, Kerberos, LDAP, SMB, RDP, WinRM) plus two extra web ports: an IIS site on 80 and a Bitbucket-branded
Summary This is the sequel to the original Endgame Trainer box. The developer clearly read that writeup - the client-side "don't let the player actually win" gate is gone entirely, and the win conditi
Summary Endgame Trainer is a small web app that presents a "mate-in-one" chess puzzle. The board is legit (built on the chess.js library), but the app has a gimmick: if you actually play the winning m
