Machines
TryHackMe
Condensed writeups from TryHackMe machines, covering recon through privilege escalation.
Gaming Server
A TryHackMe Linux box where a leaked upload-handler source and a passphrase-protected SSH key lead to a foothold, and lxd group membership finishes the job.
Basic Pentesting
A TryHackMe Linux box where an HTTP dev-notes leak and anonymous SMB access surface two usernames, a brute-forced SSH password gets a foothold as one of them, and a world-readable SSH key leads to lateral movement into the other.
Checkmate
A TryHackMe challenge that chains five escalating password attacks — hydra default-cred brute force, a CeWL site wordlist, a cupp OSINT profile, a cracked hashcat hash, and a rule-mangled wordlist to finally brute-force SSH.
Pickle Rick
A TryHackMe Linux box where a username hidden in the page source and a password sitting in robots.txt unlock a web command panel, a blacklisted `cat` is worked around with `less`, and www-data's unrestricted sudo hands over root.