Metasploitable 3

root 23 August 2026

Writeup — Vuln (Payroll SQLi → SSH → sudo Root)

Target: 192.168.1.14 · vuln.lan · Ubuntu 14.04 · hostname vuln
Attacker: 192.168.1.244 (hostname jim, user bob)
Objective: exploit the easiest / quickest service. Result: full root compromise via web-app SQL injection.

Attack chain at a glance

THM BankGPT

root 14 August 2026

Writeup — BankGPT (Prompt Injection / LLM Jailbreak)

TryHackMe · BankGPT · LLM / AI Pentesting · Easy
"It isn't supposed to share what it knows, and the system administrators carefully review everything you send to it."
Objective

THM Love Letter Locker

root 14 August 2026

Writeup — "LoveLetter Locker" (IDOR)

TryHackMe · Cupid’s "LoveLetter Locker" · Flask web app on port 5000
An insecure object reference that lets any user read anyone else’s love letters by number.
Objective
Exploit a broken access control on the letter archive: enumerate letter IDs and read a letter you don't own, recovering the flag hidden inside another user's message.
Flag

THM Cupids Matchmaker

root 14 August 2026

Writeup — "Cupid's Matchmaker" (Stored XSS → Admin Bot)

TryHackMe · "Cupid's Matchmaker" (Love At First Breach 2026) · Flask web app on port 5000
"No AI, just human matchmakers." — the human reviewer is a headless browser that renders your survey un-sanitized.
Objective

THM Room404

root 11 August 2026
✘ BYTE LOTUS

engagement notes · internal

— findings —

The repo never left the server.

A staging deploy of the Byte Lotus guest platform shipped with its .git directory sitting in the public webroot. That one oversight was enough to walk the commit history straight back to a flag someone meant to delete before launch — and never did.

THM BeachBar

root 11 August 2026
TryHackMe // Writeup

🏖️ Beach Bar

Easy Category: Web Exploitation → Insecure Deserialization → Credential Reuse Privesc

Beach Bar is a themed easy-difficulty box centered around a Flask web app ("jukebox manager") for a beach bar. The path to root runs through a hidden demo credential, an unsafe YAML deserialization RCE, and a plaintext password leaked in a running process's command-line arguments.

THM Do Not DIsturb

root 11 August 2026
— poolside intrusion report —

Do Not Disturb

Byte Lotus never forgets — and neither did whoever got there first. A full walkthrough from anonymous visitor to root, via a warm session, a booby-trapped template, and a debugger left cracked open on the beach.

Subscribe to