Debrief archive.

BlockSynergy is an insane-difficulty Linux box built around a Flask "blockchain" web application and a developer-centric smart-contract / backup pipeline.

Jeeves is a medium-difficulty standalone Windows box built around a forgotten Jenkins instance and a developer's password manager.

DanglingTree is a medium-difficulty Windows Active Directory box built around a Server 2025 domain controller that doubles as an Enterprise CA and hosts a Windows Admin Center portal and a SmarterMail server.

Bedside is a medium-difficulty Linux box whose foothold is a pickle-deserialization bug in pdfminer.six (CVE-2025-64512), and whose root is the same bug class in a MONAI trainer's torch.load().

Cohort is a hard-difficulty Linux box built around a client-rendered analytics site whose "report source validator" is a full-read SSRF.

MakeSense is a hard-difficulty Linux box built around a WordPress 7.0 site running a bespoke webagency theme, an admin-review bot, and a root-owned OCR web service.

Paperwork is a medium-difficulty Linux box built around three hand-rolled "print" services, each reusing the same class of unsafe input handling.

Enigma is a medium-difficulty Linux box built around a self-hosted mail stack, an Italian invoicing application (OpenSTAManager), and an automation panel (OliveTin) running as root.

Checkpoint is a medium-difficulty Windows Active Directory box built around a Server 2025 domain controller and a developer-centric "approved VS Code extension" deployment workflow.

DevArea is a medium-difficulty Linux box built around a Java SOAP web service and an internal Hoverfly API-simulation server.

Facts is an easy Linux box chaining a Camaleon CMS mass-assignment flaw with a misconfigured MinIO/S3 backend.

Pterodactyl is a medium-difficulty Linux box running the Pterodactyl game-server panel on openSUSE.

Silentium is an easy Linux box chaining three 2025 CVEs across a Flowise AI-workflow app and an internal Gogs instance.

Trick is an easy-difficulty Linux box themed around a healthcare/payroll web stack fronted by NGINX, with an exposed BIND DNS server.

WingData is an easy Linux box chaining an unauthenticated Wing FTP Server RCE with an insecure-tarfile sudo script.

The Connected machine is a Linux-based target that emphasizes web application exploitation leading to RCE, followed by local system enumeration to escalate privileges.

DevHub is a medium-difficulty Linux box built around modern development and AI infrastructure.

Fluffy is an easy-difficulty Windows Active Directory machine structured as an assumed breach scenario, where low-privileged initial credentials are provided.

Today I pwned Reactor from Hack The Box. This machine focused heavily on modern web exploitation and insecure Node.js deployment practices.