ctf

Writeups & challenge notes.

Selected solves across HTB, THM, and original challenges — focused on methodology over flag-chasing.

Aug 11, 2026THMMedium12 min

Management Wants a Word | TryHackMe Writeup

TryHackMe Management Wants a Word writeup: analyze KAPE, recover DPAPI and Chrome credentials, then open the hidden VeraCrypt vault. Final flag redacted.

#thm#forensics#dpapi#veracrypt#chrome#dfir

Aug 11, 2025HTBHard9 min

HTB · Cerberus — Three-Headed Privilege Escalation

Chaining an SSRF in a SAML responder with a misconfigured ADCS template for domain admin.

#htb#ad#saml#adcs

May 22, 2025THMMedium7 min

THM · Glyph — Reversing a Custom VM

Recovering the bytecode dispatcher of a hand-rolled stack VM and decrypting the flag with a 40-line Python lifter.

#thm#re#vm