I pwned the HTB machine BoardLight by discovering a hidden vhost (crm.board.htb), logging into Dolibarr with default creds, and exploiting CVE-2023-30253 to gain a user shell. After finding DB credentials in conf/conf.php and landing as larissa, I used a discovered Enlightenment RCE (CVE-2022-37706) to escalate to root and capture the root flag.
I solved the “Packed” reverse engineering challenge at BSides Galway CTF by identifying a UPX-packed executable, unpacking it, and analyzing it in BinaryNinja — where the flag was hidden in the main function.
I documented my approach to solving the PearlCTF 2024 forensics challenge The-3-Fragmenteers, where I analyzed a Windows memory dump, recovered hidden files, and pieced them together to extract the final flag.