Writeups
Walkthroughs of machines and CTF challenges I've solved, written up with the same rigor I'd use in a professional engagement report: full attack chain, screenshots, and remediation notes.
Fortaleza: OS Command Injection to NT AUTHORITY\SYSTEM
Finding an unauthenticated OS command injection in an internal ASP.NET help-desk "ping utility", using it to drop a Meterpreter payload, and landing directly on NT AUTHORITY\SYSTEM through a misconfigured IIS Application Pool identity.
Angel: Pivoting, SambaCry, and a Container Breakout
Once inside the internal network reached by pivoting from Editorial: exploiting a shared network resource (SambaCry), abusing a misconfigured Docker container, and cracking the host's password hash offline to take over the real target behind the container.
Editorial (Imprenta): From Anonymous FTP to Root
Chaining anonymous FTP credential disclosure, credential reuse against WordPress, and an authenticated theme-editor RCE to land a foothold — then abusing a world-readable SSH private key and a wide-open sudo policy to escalate to root.