Herramientas & Tutoriales on Hackpuntes

Discovering Tradecraft Garden

Tue, 02 Dec 2025 00:00:00 +0000

Taking advantage of the recent Black Friday deals, I decided to purchase the CRTL (Certified Red Team Lead) course from ZeroPointSecurity. While the material is dense and deeply technical (typical of Rasta Mouse ), one of the first gems I stumbled upon isn’t hidden behind a paywall. It’s a public project that deserves much more attention from the community: Tradecraft Garden .

Essentially, this repository is a development environment or “playground” designed to drastically simplify the creation of Shellcode and Position Independent Code (PIC) using C and Makefiles.

TryHackMe - Machine - Pickle Rick v2

Mon, 17 Nov 2025 00:00:00 +0000

Hey hackers! 👋

Today we’re diving into the Pickle Rick machine on TryHackMe. It’s a classic 🟩 Easy challenge, perfect for practicing web enumeration and basic privilege escalation.

🚀 Before Starting

Add the machine to the /etc/hosts file, check connectivity with ping, and create the working folders

echo '10.10.34.26\tpicklerick.thm' | sudo tee -a /etc/hosts
ping -c 1 picklerick.thm
mkdir -p ~/thm/picklerick/{exploits,fuzz,http,nmap}
cd ~/thm/picklerick/

🔎 Reconnaissance

Scan with nmap

Check all ports that are open, detect the service and its version with nmap and generate all.html to see information.

Snyk Fetch The Flag - TimeOff

Sun, 09 Mar 2025 00:00:00 +0000

In this CTF challenge, we are tasked with performing a pentest on a web application following the Model-View-Controller (MVC) pattern, developed in Ruby on Rails. The application allows employees to request time off, and we are provided with the source code and two credentials (admin and user).

While reviewing the application, we noticed that the time-off request form allows file uploads, which is always an interesting point to investigate during a security audit.

Snyk Fetch The Flag - Coding Mountains

Sat, 08 Mar 2025 00:00:00 +0000

Scripting challenges are my favorite in CTFs, and this one has undoubtedly been my favorite from Snyk Fetch The Flag 2025. The challenge consists of answering 50 quick questions about the most famous mountains on Earth. We need to answer with their height (in feet) and the year they were first climbed using the following format: height,year.

A sample of the game start:

Snyk Fetch The Flag - ClickityClack

Fri, 07 Mar 2025 00:00:00 +0000

In this challenge, we started with a pcapng file that contains the hidden flag inside. Initially, I tried to analyze it using Wireshark, but couldn’t find anything relevant. That’s when a simple Google search gave me the key clue:

pcapng usb ctf

This search led me to discover a tool called Usb_Keyboard_Parser.py that parses USB traffic packets, such as keypresses.

Snyk Fetch The Flag - Science 100

Thu, 06 Mar 2025 00:00:00 +0000

In this CTF challenge, we encounter a Robco Industries terminal, similar to the ones found in the Fallout video game series. Our mission is to decipher the correct password using the Likeness mechanic, which tells us how many letters match in the exact position with the correct password.

🖥️ Connecting to the Challenge

$ nc challenge.ctf.games 32377

Upon connecting, the system welcomes us and presents a list of potential passwords hidden among random symbols.

Snyk Fetch The Flag - CTF 101

Wed, 05 Mar 2025 00:00:00 +0000

This challenge is designed as an introduction to CTFs (Capture The Flag). It is a simple challenge aimed at getting familiar with exploiting vulnerabilities in web applications.

By analyzing the provided source code, we can see that it is a web application developed with Flask (Python). Here is the code:

from flask import Flask, render_template, request, redirect, flash
import subprocess

app = Flask(__name__)
app.secret_key = "supersecretkey"

@app.route("/", methods=["GET", "POST"])
def index():
 if request.method == "POST":
 name = request.form.get("name", "").strip()

 if not name:
 flash("Error: Name cannot be empty.", "error")
 return redirect("/")

 try:
 # I sure hope no one tries to run any commands by injecting here...
 output = subprocess.check_output(f"echo {name}", shell=True, text=True, stderr=subprocess.STDOUT)
 flash(f"Hello, {output.strip()}! Good luck!", "success")
 # ...alright, the challenges won't be this obvious on game day, but I hope it gives you a good idea of how the game is played!
 except subprocess.CalledProcessError as e:
 flash(f"Error: {e.output.strip()}", "error")

 return redirect("/")

 return render_template("index.html")

if __name__ == "__main__":
 app.run(host="0.0.0.0", port=5000)

🔍 Where is the vulnerability?

The main issue lies in the following piece of code:

Snyk Fetch The Flag - Screaming Crying Throwing up

Tue, 04 Mar 2025 00:00:00 +0000

This challenge consists of decrypting a binary file encrypted with scream . To do this, we can use the Scream Cipher Translator .

If we open the screaming.bin file in VSCode, we will see the following content:

a̮ăaa̋{áa̲aȧa̮ȧaa̮áa̲a̧ȧȧa̮ȧaa̲a̧aa̮ȧa̲aáa̮a̲aa̲a̮aaa̧}

However, if we use cat in the terminal (CMD, PowerShell, or Bash), we get a different result:

$ cat screaming.bin
aăaa{áaaȧaȧaaáaaȧȧaȧaaaaaȧaaáaaaaaaaa}

⚠️ Attention! ⚠️

Snyk Fetch The Flag - Unfurl

Mon, 03 Mar 2025 00:00:00 +0000

In this challenge, we face a web application that fetches metadata from any URL entered into the form.

A quick analysis of the source code reveals that the application is developed in NodeJS, and the use of the child_process module suggests the possibility of remote command execution (RCE).

📄 adminRoutes.js file

const { exec } = require('child_process');

router.get('/execute', (req, res) => {
 // This isn't terribly secure, but we're only going to bind this app to the localhost so you'd need to be on the actual host to run any commands.
 // So I think we're good!
 const clientIp = req.ip;

 // Definitely making sure to lock this down to the localhost
 if (clientIp !== '127.0.0.1' && clientIp !== '::1') {
 console.warn(`[WARN] Unauthorized access attempt from ${clientIp}`);
 return res.status(403).send('Forbidden: Access is restricted to localhost.');
 }

 const cmd = req.query.cmd;

 if (!cmd) {
 return res.status(400).send('No command provided!');
 }

 exec(cmd, (error, stdout, stderr) => {
 if (error) {
 console.error(`[ERROR] Command execution failed: ${error.message}`);
 return res.status(500).send(`Error: ${error.message}`);
 }

 console.log(`[INFO] Command executed: ${cmd}`);
 res.send(`
 <h1>Command Output</h1>
 <pre>${stdout || stderr}</pre>
 <a href="/admin">Back to Admin Panel</a>
 `);
 });
});

The code indicates that the application allows executing commands on the /execute endpoint via the cmd parameter, but only locally.

Snyk Fetch The Flag - Zero Ex Six One

Sun, 02 Mar 2025 00:00:00 +0000

In this challenge, we obtain a file named flag.txt.encry, which contains a hexadecimal string.

$ cat flag.txt.encry
0x070x0d0x000x060x1a0x020x540x510x050x590x530x020x510x000x530x540x070x520x040x570x550x550x050x510x560x510x530x030x550x500x050x030x050x510x590x540x000x1c

The 💡 hint in the challenge description suggests that an XOR encryption was used, and the challenge title, Zero Ex Six One, might indicate that the encryption key is 0x61.

I'm XORta out of ideas for how to get the flag. Does this look like anything to you?

Solution 1 - Using the Encryption Key

In this first solution, we convert the hexadecimal string into bytes and apply an XOR decryption using the key 🔑 0x61.