Hands-on labs
How to approach a target, not just how to get the flag. CTF write-ups are free/beginner rooms only, always after any platform embargo period. CVE labs are real disclosed vulnerabilities reproduced in an isolated environment you run yourself. Technique labs are deliberately misconfigured environments teaching a generic technique class, not tied to any CVE. RSS feed.
CVE Labs
CVE-2026-68771: ComfyUI Unauthenticated RCE via Pickle Deserialization
An unauthenticated upload endpoint and a node that deserializes whatever lands in a folder combine into remote code execution with no login at all.
CVE-2026-65008: Grav CMS Authenticated RCE via Blueprint Callable Injection
What it actually takes to adapt a published PoC when it was written against an admin interface your target doesn't run.
CVE-2026-63720: datamodel-code-generator customBasePath Code Injection RCE
A code generator trusts a schema field enough to paste it, unescaped, into the Python module it writes — and that module runs on import.
CVE-2026-63030: WordPress Core Pre-Auth Admin Takeover ("wp2shell")
Two chained bugs in WordPress core, no plugin involved, combine into unauthenticated administrator account creation — actively exploited right now.
CVE-2026-62183: Apache Syncope Privilege Escalation
A self-service API endpoint in Apache Syncope lets any authenticated user grant themselves admin-level roles.
Privilege Escalation Techniques
Cron Job Hijacking: Escalating a World-Writable Script
Root's crontab runs a backup script every minute; it was left world-writable, so replacing it is all it takes — then waiting for the clock.
Linux Capabilities Abuse: Escalating Through cap_setuid
A capability meant for one narrow helper binary was set on the Python interpreter itself, handing that power to every script it runs.
Sudo Misconfiguration: Escalating Through a NOPASSWD Rule
An unrestricted NOPASSWD sudo rule on vim, granted so config edits wouldn't need a password every time, turns into a full root shell.
SUID Binary Abuse: Enumerating and Escalating with GTFOBins
A leftover SUID bit on find from a one-off maintenance task is all it takes — enumerate, cross-reference GTFOBins, and escalate.
Writable /etc/passwd: Forging a Root Account
Weak permissions on /etc/passwd let you write your own root-equivalent account directly into the file — no exploit required, just a text edit.
CTF Walkthroughs
TryHackMe: Blue — Walkthrough and Methodology
A methodology-focused walkthrough of TryHackMe's free Blue room — exploiting EternalBlue (MS17-010) on an unpatched Windows 7 target.
HackTheBox: Lame — Walkthrough and Methodology
A methodology-focused walkthrough of HackTheBox's Lame, one of the oldest retired beginner boxes — Samba RCE from recon to root.