Cody Richard@ssstrickys

write-ups — memory regions // 0x00003000 permissions read execute

Mapped regions

0x1000–0x1fff r-x reversing · hard

rev_sysprobe — Five-Layer Packer to a Bit-Encoded Flag (HTB Operation Nightfall)

A 33 KB x86-64 ELF posing as a benign diagnostics tool, hiding its flag behind five sequenced layers: a hidden RWX PT_LOAD, a self-decompressing loader, a section-stripped inner ELF, an index-keyed-XOR bytecode interpreter, and a 2-bits-per-slot .rodata table — reduced to an end-to-end recovery in two commands.

reversingpackerelfhtb
0x2000–0x2fff r-x reversing · very easy

rev_shadow_ledger — Flag-in-Plaintext, with Theatre (HTB Operation Nightfall)

A 26 KB stripped ELF posing as a “verification node” that demands an 8-digit hex auth key. The 32-bit key check is genuine — but solving it buys nothing: the flag lives in plaintext in .rodata and prints on every path, including the failure path. The test is psychological, not technical.

reversingelfrodatahtb
0x3000–0x3fff r-x reversing · insane

Enthiran — Neural-Network-Backed Binary (HTB Operation Nightfall)

A stripped ELF64 hiding a 16-32-8-1 MLP whose dead-code path emits the flag. Conventional reversing finds nothing — solved by reasoning about L2 activations quantized to exact n/256 values and snapping FP rounding back to the build-time input.

reversingneural-netelf64htb
0x4000–0x4fff r-x reversing · medium

rev_dudsat — Doppler-Indexed Permutation Leak (HTB Operation Nightfall)

A satellite Link Budget Processor ELF hiding its flag in a dead store. Three layers: an .init_array LCG Fisher-Yates shuffle, Doppler-themed FP arithmetic as a table index, and a stack value the printed output never reads.

reversinglcgdead-storehtb
0x5000–0x5fff r-x reversing · vm

Ghost — Custom VM Bytecode Interpreter (SDG)

A stripped ELF64 running a 99-opcode custom virtual machine against a 666-byte bytecode. Recovered the full ISA, disassembled the flag-check routine, and extracted the passphrase via symbolic execution of the KV-store logic.

reversingvmisa-recoverysdg
0x6000–0x6fff r-- crypto · coppersmith

Patient Zero 2 — RSA e=3 Coppersmith / LLL Attack (SDG)

RSA with e=3 and a predictably structured plaintext. Expressed the message as a linear polynomial in the unknown flag, made it monic via substitution, exploited the SDG{} format to shrink the unknown to 256 bits, and recovered the flag with SageMath small_roots() in ~10 seconds.

cryptorsacoppersmithlllsdg
0x7000–0x7fff r-x web · ssrf→rce

web_ssrf_to_rce — SSRF to Remote Code Execution via an Internal Admin Panel

A public PDF-rendering endpoint fetches any attacker-supplied URL with no egress validation — a textbook SSRF. Pointed at the loopback interface, it reaches an internal /admin panel that trusts network position alone and exposes a raw ?cmd= runner, chaining to unauthenticated RCE inside an AWS ECS Fargate task. The highest-impact step pivots from the container to the cloud account by lifting the task's IAM-role credentials from the ECS credentials endpoint (169.254.170.2 — not the EC2 IMDS that Fargate doesn’t expose). Black-box, unauthenticated, CVSS 10.0.

webssrfrceawscloud
0x8000–0x8fff r-x web · ctf→10/10

web_murmur — Full-Estate Compromise of a Microservice Social Platform

Ten flags across a dozen containerized services, taken end to end from an unauthenticated black-box start. A GraphQL updateProfile(role:"admin") mass-assignment leaks the platform’s RS256 signing key — the master credential that forges any identity across the mesh. From there: Elasticsearch query_string injection, two RCE primitives (ExifTool DjVu · link-preview command injection), a stored-XSS moderator takeover, a Grafana traversal (CVE-2021-43798) that yields a root SSH key, a Drone fork-PR secret leak, and an IDOR in the admin DM viewer that exposes the boardroom. Every flag is documented both ways — the intended path and the operational shortcut.

webgraphqlrcessrfxssidorci/cd
0x9000–0x9fff r-x reversing · keygen

rev_sentinel — ARM64 License Crackme Keygen via a Reversed derive_key (HackerDNA)

A not-stripped ARM64 activation client validates SENT-XXXX license keys against an account name — its four intact symbols (main, validate, derive_key, decode_token) expose the entire design. An undocumented --diag subcommand XOR-decodes a hidden .rodata flag under key 0x5A. Because the check compares the key to a pure function of the account name, reimplementing derive_key forges a valid admin license for any account.

reversingkeygenaarch64xorelfcrackme
0xa000–0xafff r-x pwn · ret2win

pwn_securestack — Web Foothold to an ARM64 SUID ret2win Root (HackerDNA)

Directory fuzzing exposes an /auth.log that names the only account that actually logs in; an X-Forwarded-For spoof defeats the portal’s internal-only allow-list, so that rockyou-cracked credential lands a session. The authenticated ping tool filters shell metacharacters but not a newline — command execution as www-data. The real prize is a SUID-root ARM64 binary with a textbook stack overflow and a one-gadget win path, smuggled past a word-blocking filter for a ret2win to root.

pwnbuffer-overflowret2winaarch64suidweb
0xb000–0xbfff r-x web · idor→rce

web_broken_chain — IDOR to Root via Zip-Slip, Debug-Mode SSTI, and a Computed Werkzeug PIN (HackerDNA)

An unscoped IDOR on a Flask blog leaks a confidential post carrying the dev admin password. As admin, a Zip Slip in the upload handler overwrites a rendered template — and because the app runs debug=True with template auto-reload, that write becomes Jinja RCE. A second root-owned backup service, also in debug mode, exposes a Werkzeug console whose PIN is recomputable from on-box machine facts — a root Python shell.

webidorzip-slipsstiflaskwerkzeug
0xc000–0xcfff r-x web · scada→rce

web_compromised2 — SCADA APK Creds to Container Root via FUXA runscript RCE (HackerDNA)

An open /backup/ directory on a FUXA SCADA host serves a companion Android APK holding a hard-coded operator credential, XOR-obfuscated under the four-byte key send. That credential unlocks POST /api/runscript in test-mode, which FUXA compiles as a real Node module via Module._compile — unsandboxed RCE as www-data. A root-owned Tomcat in the same container falls to a localhost-only WAR deploy driven through a CSRF-token dance, landing a root JSP.

webscadafuxaapk-reversingrcetomcat
0xd000–0xdfff r-x web · ssti→root

web_fortipy — SSTI to Root via a Hex-Escape WAF Bypass (HackerDNA)

A Flask /welcome endpoint concatenates a query parameter into render_template_string — textbook SSTI, nominally guarded by a case-insensitive substring blacklist. Jinja resolves \xNN string escapes only after the filter has inspected the raw bytes, so hex-encoding the payload smuggles every blocked token straight through. The process runs as PID 1 / root, so a single injected subprocess.check_output gadget returns uid=0 and both flags.

websstijinja2waf-bypassflaskrce
0xe000–0xefff r-x web · cmdi→root

web_internal — Spoofed X-Forwarded-For Command Injection to cap_setuid Root (HackerDNA)

A Gunicorn/Flask “Networking Services” ping tool concatenates the host field into subprocess.getoutput — command injection nominally gated by an alphanumeric-only regex. The gate is skipped entirely for any request carrying X-Forwarded-For: 127.0.0.1, a header the client fully controls, so spoofing it restores arbitrary execution as sysadmin. On the host, getcap finds /app/python3new holding cap_setuid=ep, and os.setuid(0) is a one-line root shell.

webcommand-injectionx-forwarded-forflaskcap-setuidprivesc
0xf000–0xffff r-- web · cms leak

web_mythos — Sanity CMS Draft Exposure and Revision-History Token Leak (HackerDNA)

A Next.js site is backed by a publicly readable Sanity dataset that keeps unpublished drafts as documents whose _id begins with drafts.. A GROQ query over path('drafts.**') discloses an embargoed frontier-model announcement. A deleted internal briefing is then resurrected through Sanity’s revision-history API, recovering an API token a migration accidentally left in an author-notes field — the credential to a separate, non-public dataset.

webheadless-cmssanitygroqinfo-disclosuretoken-leak
0x10000–0x10fff r-x web · rce→root

web_pwnify — Mass-Assignment to Root via ffmpeg Tag Command Injection (HackerDNA)

A music app’s profile-update whitelist mistakenly includes the server-side is_artist flag, so a listener mass-assigns themselves into an artist and unlocks the transcoding Studio. The Studio stamps the artist-supplied title into an ffmpeg ID3 tag via an unescaped shell string — -metadata title='{title}' — yielding command injection as the web user. Dumping SQLite cracks the founder’s MD5 for SSH reuse, and a world-readable config leaks a service account whose SUID helper pwnify-enc --uid 0 never checks for root.

webmass-assignmentcommand-injectionffmpegsuidprivesc
0x11000–0x11fff r-x web · cve→root

web_wp_ultimate — Ultimate Member Homoglyph Privesc (CVE-2023-3460) to Root (HackerDNA)

WordPress running Ultimate Member 2.6.6 is vulnerable to CVE-2023-3460: the plugin’s key blacklist compares submitted user-meta with byte-exact stripos() while the value is accent-folded to ASCII before storage. Submitting wp_càpabilities[administrator] with a Unicode à (U+00E0) reads as “not wp_capabilities” to the filter and “exactly wp_capabilities” to the database, self-registering a full administrator. A one-file malicious plugin gives a www-data webshell, wp-config.php’s DB password is reused for SSH, and a sudo /bin/cat reads the root flag.

webwordpresscve-2023-3460homoglyphprivescrce