Hero Image
Job — VulnLab Writeup

Job is a medium-difficulty Windows machine on VulnLab. The attack chain involves crafting a malicious LibreOffice macro sent via SMTP to gain an initial foothold, then escalating to SYSTEM by abusing SeImpersonatePrivilege with GodPotato.
Monday, March 23, 2026 | 4 minutes Read
Hero Image
Cicada — HackTheBox Writeup

An easy-rated HTB Active Directory machine. The attack chain involves SMB guest enumeration, RID brute-forcing, password spraying, LDAP dumping, and finally abusing SeBackupPrivilege to extract the Administrator hash.
Monday, January 12, 2026 | 3 minutes Read
Hero Image
Media - VulnLab Writeup

Exploiting a .wax file upload to steal NTLMv2 credentials, then escalating privileges via SeImpersonate using GodPotato on a Windows target.
Sunday, January 11, 2026 | 3 minutes Read
Hero Image
UpDown - HackTheBox Writeup

UpDown is a medium Linux box where you chain an exposed .git repo, a custom header bypass, and a Phar wrapper LFI + file upload to get a shell. Root involves Python 2 input() injection on a SUID binary, then easy_install sudo abuse via GTFOBins.
Friday, January 9, 2026 | 4 minutes Read
Hero Image
Busqueda — HackTheBox Writeup

A walkthrough of HackTheBox Searcher — exploiting CVE-2023-43364 (Searchor 2.4.0 RCE) for initial access, then leveraging a path injection vulnerability in a privileged Python script to escalate to root.
Thursday, January 8, 2026 | 4 minutes Read
Hero Image
Introduction

Hi, I’m Nitel 👋 Application Security & Penetration Testing Specialist based in Seoul, South Korea. I write about offensive security, penetration testing, and the intersection of secure development — from breaking things in labs to building them the right way in production. What I Do I’m an offensive security professional with a background in full-stack development (React.js / Node.js). I hold the HTB Certified Penetration Testing Specialist (CPTS) and PJPT certifications, and I’m currently pursuing OSCP.

Monday, June 8, 2020 | 2 minutes Read