Misc

A SQLi login leaked the vending machine config, which spoke MQTT over WebSockets. Flipping the right switch topic vended the item. First blood.

Enumeration of an SMB host: protocol, encryption, domain, and SIDs. Recon only, no flag in my notes.

An exposed finger service leaked a user, and that user’s plan field held the flag.

A calculator Discord bot ran user input through eval behind a substring blacklist, which fell to string splitting and hex escapes.

A GIF of a scribbled-over QR code, recovered by stacking every frame so the gaps filled each other in.

The author left Vim running, so the server source leaked through a .swp file.

An NFS share leaked an SSH key, a cipher and a cracked zip gave users, and no_root_squash planted a SUID bash.

A raw TCP service handed out a TLS key and cert, mutual TLS opened a shell, and layered encoding plus CrackStation gave root.

A writable FTP script on a timer gave a shell, and SUID env gave root.

Anonymous FTP and hydra gave SSH, a cookie-equals-password page gave a webshell, and python cap_setuid gave root.