Field resources // Write-ups

Write-ups. Attack. Detect. Defend.

Walkthroughs from my lab and capture-the-flag work, written the way I’d document an investigation: what I saw, what I did, what it means, and how to defend against it.

6 write-ups
Red Team
Blue Team
DFIR

TryHackMe // OffensiveInfrastructure Penetration TestFull lifecycle assessment: Nmap enumeration turns up a backdoored UnrealIRCd service, Metasploit lands a reverse shell, and a plaintext password file on disk leads straight to root.NmapMetasploitPrivilege escalationReportingRead write-up →TryHackMe // OffensiveNode2Shell – CVE-2026-111497An out-of-bounds write in the Brotli decoder bundled with Node.js turns HTTP compression into unauthenticated remote code execution against an Express app.Node.jsRCECWE-787Patch managementRead write-up →TryHackMe // OffensiveAttacktive DirectoryKerberos username enumeration, AS-REP roasting, credentials left in an SMB share, replication abuse to dump domain hashes, and Pass-the-Hash to the domain controller.Active DirectoryKerberosSMBPass-the-HashRead write-up →TryHackMe // DFIRBoogeyman 1A phishing shortcut launches hidden PowerShell. Recover the payload from a PCAP, decode the C2 traffic, and separate the HTTP command channel from DNS exfiltration.PCAP analysisPowerShellC2ExfiltrationRead write-up →TryHackMe // DFIRBoogeyman 2A phishing email with a macro-laden resume. Trace the Word document to script execution in a Windows memory dump, recover the C2 endpoint, and pull the scheduled-task persistence command.Memory forensicsVolatility 3Phishing analysisPersistenceRead write-up →TryHackMe // DFIRBrainsPost-exploitation forensics in Splunk. Find the backdoor account, the suspicious package, and the malicious TeamCity plugin an attacker left on a compromised Linux server.SplunkLinux logsTeamCityPersistenceRead write-up →