https://thedevilhunter.dev/ Offensive security research, Hack The Box and TryHackMe writeups, CTF solutions, and red-team notes. en-us Mon, 27 Jul 2026 00:00:00 GMT https://thedevilhunter.dev/posts/sekai-ctf-2026-apbq-rsa-iv.html https://thedevilhunter.dev/posts/sekai-ctf-2026-apbq-rsa-iv.html Mon, 27 Jul 2026 00:00:00 GMT Three mixed RSA hints become one public lattice vector. A hidden split, a CRT-idempotent equation, and a multivariate Coppersmith construction recover the factors. crypto rsa lattice lll coppersmith crt small-roots sekai-ctf https://thedevilhunter.dev/posts/htb-devvortex.html https://thedevilhunter.dev/posts/htb-devvortex.html Wed, 22 Jul 2026 00:00:00 GMT A vhost hiding a Joomla install leaks admin creds via CVE-2023-23752, which opens a PHP webshell foothold. From there, cracked MySQL hashes and a sudo-able apport-cli GTFOBin hand over root. joomla cve-2023-23752 vhost-fuzzing sudo apport-cli gtfobins hashcat https://thedevilhunter.dev/posts/thm-blue.html https://thedevilhunter.dev/posts/thm-blue.html Sat, 18 Jul 2026 00:00:00 GMT The classic EternalBlue room. Fingerprint an unpatched Windows 7 box, fire MS17-010 through Metasploit for a SYSTEM shell, then migrate, dump hashes, and crack them offline. eternalblue ms17-010 smb metasploit windows hashdump cve-2017-0144 https://thedevilhunter.dev/posts/ctf-web-cookie-monster.html https://thedevilhunter.dev/posts/ctf-web-cookie-monster.html Sun, 12 Jul 2026 00:00:00 GMT A login form that trusts a base64 cookie a little too much. Decode it, flip the admin flag, re-encode, and the flag drops straight into the response. web cookies base64 authentication-bypass burp https://thedevilhunter.dev/posts/building-a-methodology.html https://thedevilhunter.dev/posts/building-a-methodology.html Wed, 08 Jul 2026 00:00:00 GMT Most boxes aren't lost at exploitation — they're lost at enumeration. Here's the checklist-driven recon workflow I run on every target so I never miss the obvious foothold again. methodology enumeration recon nmap checklist