CTF Achievements & Platforms

Active on HackTheBox (Seasons 8, 10, 11), pwn.college, TryHackMe, RootMe and 404CTF. Full session notes in the challenge log.

12+
Machines PWNED
5
HTB Certifications
3
HTB Seasons Active
2
404CTF Editions

Platforms

HackTheBox
Seasons 8, 10, 11 - Windows AD, Linux, Web
pwn.college
Binary exploitation: buffers, shellcode, heap, sandbox, ROP
TryHackMe
Learning paths, Blue Team, OSCP prep
RootMe
Crypto, programming, web challenges
404CTF
2023 & 2024 - annual French CTF
pwn.college Profile Challenge Log

HackTheBox Season 10 - 6 machines fully compromised across Linux and Windows Active Directory environments.

CCTVLinux / Ubuntu 24.04
EASY Linux PWNED
CVE: CVE-2024-51482 (ZoneMinder SQLi blind) · CVE-2025-60787 (motionEye image_file_name RCE)
ZoneMinder default creds (admin:admin) -> sqlmap time-based SQLi on tid param -> mark:opensesame (SSH) -> SSH local port forward :8765 (motionEye) -> CVE-2025-60787 command injection via image_file_name -> root
SQLi blind time-basedSSH port forwardingCommand injectionDefault credentialssqlmap
KoboldLinux / Ubuntu 24.04
MEDIUM Linux PWNED
Techniques: MCPJam serverConfig RCE · PrivateBin LFI via cookie template · Docker breakout via Portainer admin credentials
MCPJam /api/mcp/connect serverConfig command injection -> user flag -> PrivateBin template cookie LFI -> PHP webshell in /privatebin-data/ -> conf.php creds (arcane:ComplexP@sswordAdmin1928) -> Portainer -> docker run --rm -v /:/hostfs -> root flag
MCP RCELFI via cookiePHP webshellDocker escapePortainer
VariaTypeLinux / Debian
MEDIUM Linux PWNED
CVE: CVE-2025-66034 (fonttools arbitrary file write via CDATA + path traversal) · CVE-2024-25081 (FontForge ZIP filename command injection) · CVE-2025-47273 (setuptools %2F path traversal)
vhost fuzzing (ffuf) -> exposed .git dump -> credential leak in git diff (gitbot) -> CVE-2025-66034: malicious .designspace CDATA injection + path traversal -> PHP webshell -> www-data -> CVE-2024-25081: ZIP with malicious filename triggers cron FontForge -> steve -> sudo CVE-2025-47273 setuptools %2F -> write authorized_keys -> root SSH
git dumpCDATA XML injectionPath traversalCron abusesudo escapefonttoolsFontForge
OverwatchWindows Server 2022 / AD
HARD Windows AD PWNED
Techniques: SMB null session · .NET binary analysis (strings -e l) · MSSQL linked server + DNS poisoning · Responder cleartext capture · SOAP/WCF command injection
SMB null -> software$ share -> strings on .NET binary: sqlsvc:TI0LKcfHzZw1Vv -> MSSQL :6520 -> linked server SQL07 (no DNS) -> dnstool.py: add SQL07 -> our IP -> Responder captures sqlmgmt:bIhBbzMMnB82yx cleartext -> WinRM (user flag) -> chisel port forward :8000 -> SOAP KillProcess injection (Stop-Process PowerShell) -> net user /add admin -> root
SMB enum.NET binary analysisMSSQL linked serverDNS poisoningResponderSOAP injectionChisel
GarfieldWindows Server 2019 / AD
HARD Windows AD PWNED
Techniques: BloodHound ACL abuse (WriteProperty scriptPath) · Logon Script Abuse · RBCD · RODC Golden Ticket · Key List Attack · Pass-the-Hash
BloodHound -> IT Support WriteProperty on l.wilson scriptPath -> malicious bat on SYSVOL (bloodyAD) -> reverse shell l.wilson -> ForceChangePassword l.wilson_adm -> WinRM user flag -> Ligolo-ng tunnel to 192.168.100.0/24 -> RBCD RODC01 (FAKE$ machine account) -> SYSTEM@RODC01 -> Mimikatz: krbtgt_8245 AES256 -> PRP msDS-RevealOnDemandGroup mod -> Rubeus RODC Golden Ticket -> Key List Attack: Administrator NTLM -> PTH DC01 -> root
BloodHoundACL abuseLogon scriptRBCDLigolo-ngRODC Golden TicketKey List AttackMimikatzRubeusPass-the-Hash
PirateWindows / AD
HARD Windows AD PWNED
Techniques: BloodHound enumeration · Kerberoasting · PetitPotam NTLM coercion · Rubeus ticket manipulation · Chisel pivoting
BloodHound recon -> Kerberoasting -> PetitPotam NTLM coercion -> Rubeus ticket manipulation -> Administrator@DC01 + WEB01
BloodHoundKerberoastingPetitPotamNTLM coercionRubeusChisel

HackTheBox Season 11 - active season. 2 machines fully compromised including DarkZero Returns, a dual-AD-forest hard machine.

DevHubLinux / Ubuntu
MEDIUM Linux PWNED
Techniques: MCPJam Inspector unauthenticated RCE · Jupyter token leak in process list · OpsMCP hidden tool · hardcoded API key exposing root SSH key
MCPJam /api/mcp/connect unauthenticated RCE -> mcp-dev shell -> ps auxww: Jupyter token + root OpsMCP service on :5000 -> Chisel reverse tunnel :8889 -> Jupyter terminal analyst (user flag) -> server.py: VALID_API_KEY hardcoded -> POST /tools/call ops._admin_dump target:ssh_keys -> root private key -> SSH root
MCPJam RCEProcess token leakChiselJupyter pivotHidden MCP toolHardcoded API key

HackTheBox Season 8 - 4 machines fully compromised.

FluffyWindows / AD
MEDIUM Windows AD PWNED
CVE: CVE-2025-24071 (ZIP shortcut hash leak via Explorer thumbnail)
CVE-2025-24071 ZIP hash leak -> Shadow Credentials attack -> ESC16 ADCS exploitation -> Domain Admin
CVE-2025-24071Shadow CredentialsESC16 ADCS
OutboundLinux
MEDIUM Linux PWNED
CVE: CVE-2025-49113 (RoundCube RCE) · CVE-2025-27591 (Below privilege escalation)
CVE-2025-49113 RoundCube RCE -> 3DES session decryption -> CVE-2025-27591 Below privesc -> root
CVE-2025-49113RoundCube RCE3DES decryptionCVE-2025-27591
MirageWindows / AD
HARD Windows AD PWNED
Techniques: DNS Hijacking · NATS protocol exploitation · Kerberoasting · RBCD · DCSync
DNS hijacking + NATS exploitation -> foothold -> Kerberoasting -> RBCD -> DCSync -> Domain Admin
DNS HijackingNATSKerberoastingRBCDDCSync
ArtificialLinux / ML
MEDIUM Linux PWNED
Techniques: TensorFlow malicious model RCE · Hash extraction and cracking · Backrest service privilege escalation
TensorFlow RCE via malicious model upload -> hash extraction and cracking -> Backrest service privesc -> root
TensorFlow RCEHash crackingBackrest privesc
DarkZero ReturnsWindows + Linux / 2 AD forests
HARD Windows AD PWNED
CVE: CVE-2026-33937 (Handlebars.js AST type confusion RCE) · Gitea 1.25 PR review fork approval bypass
CVE-2026-33937 AST injection RCE (darkzero) -> .env + MySQL: bcrypt crack josh:Rangers1 -> Kerberos kinit + SSO Gitea (SSPI) -> fork + malicious workflow + PR review comment (Gitea 1.25 bug: no fork approval) -> svc-runner shell -> CREATECHILD OU=GiteaMigration + ksu.mit SUID -> root SRV01 -> celia:babygurl13 -> DCSync krbtgt EXT AES256 -> Golden Ticket + extra-SID RID 1603 (InfrastructureAdministrators HTB) -> cross-realm trust -> Backup Operators HTB -> RegSaveKey SAM/SYSTEM/SECURITY DC01 -> secretsdump LOCAL: DC01$ NTLM -> DCSync Administrator HTB -> PTH smbclient root.txt
Handlebars.js RCEAST injectionGitea CI exploitKerberos SSOCREATECHILD OUksu SUIDDCSyncGolden TicketSID HistoryForest trustBackup OperatorsRegSaveKeyPass-the-Hash

Standalone event machines and annual competitions.

ConnectedLinux / FreePBX
MEDIUM Linux USER FLAG
CVE: CVE-2025-57819 (FreePBX 16 webshell upload RCE) - privesc via incron/DAHDI chain in progress
CVE-2025-57819 FreePBX RCE -> webshell -> reverse shell (asterisk) -> incron rule sysadmin_dahdi_restart chain identified -> init.conf injection attempts -> privesc in progress
CVE-2025-57819FreePBX RCEincron abuseDAHDI chainIn progress
404CTFAnnual French competition
2023 · 2024
Focus: Web challenges, cryptography, reverse engineering, OSINT, steganography
WebCryptoReverseOSINTStegano

Binary exploitation training platform. Skills validated in a proctored ESGI exam (Bachelor 3, "Gestion des exploitations") with ~30 practice exercises and a u-boot firmware vulnerability research task using CodeQL.

Memory Errors
Buffer overflow, offset calculations, stack canary bypass.
14+ levels ADVANCED
Shellcode Injection
Custom x86-64 shellcode, syscall mastery, constraint bypass.
8+ levels EXPERT
Dynamic Allocation
Heap exploitation, use-after-free, malloc/free manipulation.
2+ levels ADVANCED
Sandboxing
chroot escape, sandbox bypass via filesystem manipulation.
11+ levels EXPERT
Program Security
Binary analysis, reverse engineering, exploit development.
Multiple levels ADVANCED
Tool Mastery
pwntools, GDB/pwndbg, Python automation for exploit scripting.
Cross-category EXPERT

Academically validated in a proctored ESGI exam (Bachelor 3) - stack overflow, shellcode injection, sandbox escape and heap exploitation solved end to end with Python/pwntools. Backed by ~30 practice exercises and a firmware vulnerability research task on u-boot with CodeQL.

Stack OverflowShellcode InjectionSandbox EscapeHeap ExploitationpwntoolsCodeQL
pwn.college Profile Dojo Log

HackTheBox learning paths completed in 2024.

Active Directory Penetration Tester
BloodHound, Kerberoasting, RBCD, DCSync, domain persistence
2024 COMPLETED
AI Red Teamer
LLM prompt injection, model manipulation, AI system exploitation
2024 COMPLETED
Bug Bounty Hunter
XSS, SQLi, SSRF, IDOR, authentication bypass, OWASP Top 10
2024 COMPLETED
Senior Web Penetration Tester
Advanced web attacks, API testing, OAuth/JWT exploitation, chained vulns
2024 COMPLETED
SOC Analyst
SIEM, log analysis, incident response, threat hunting, malware triage
2024 COMPLETED