Penetration tester & cybersecurity student, ENSAM Casablanca — Top 1% on TryHackMe, found a critical P1 at OCP Group. Writeups on web exploitation & privesc.https://louizi-yassine.vercel.app/enhttps://louizi-yassine.vercel.app/writeups/abducted/https://louizi-yassine.vercel.app/writeups/abducted/A guest-writable printer share on Samba is pre-auth RCE (CVE-2026-4480), rclone's reversible "obscure" format hands over a reused SSH password, and a Samba force-user share with insecure wide-link support becomes an arbitrary-file-write into a root-writable systemd drop-in.Mon, 10 Aug 2026 00:00:00 GMTHackTheBoxsambarceprivescpassword-reusehttps://louizi-yassine.vercel.app/writeups/hacker-holidays-day14/https://louizi-yassine.vercel.app/writeups/hacker-holidays-day14/A KAPE triage image of an abandoned laptop yields one saved Chrome password, decrypted entirely offline through a DPAPI masterkey → Local State → AES-GCM chain, which turns out to be the passphrase for a hidden VeraCrypt volume holding the real evidence.Sun, 09 Aug 2026 00:00:00 GMTTryHackMehacker-holidaysforensicsdpapiveracrypthttps://louizi-yassine.vercel.app/writeups/nimbus/https://louizi-yassine.vercel.app/writeups/nimbus/Enumeration notes only — this box is still active on HackTheBox, so the exploit chain stays unpublished until it retires. Recon points at a cloud-native, container/AWS-emulation themed target.Sun, 09 Aug 2026 00:00:00 GMTHackTheBoxenumerationreconhttps://louizi-yassine.vercel.app/writeups/hacker-holidays-day12/https://louizi-yassine.vercel.app/writeups/hacker-holidays-day12/Persistence hiding outside every autoruns tool's coverage — a malicious WMI class buried in the raw CIM repository carries a compressed .NET payload that only detonates on the domain controller by name.Fri, 07 Aug 2026 00:00:00 GMTTryHackMehacker-holidaysforensicswmi-persistencedotnet-reversinghttps://louizi-yassine.vercel.app/writeups/nexus/https://louizi-yassine.vercel.app/writeups/nexus/Two independent leaks combine to log into a CRM as the wrong-but-reused password, an authenticated file-upload CVE gets a shell, and a custom root-owned systemd timer with unsanitised git plumbing is abused via a hand-crafted malicious tree object to plant an SSH key as root.Fri, 07 Aug 2026 00:00:00 GMTHackTheBoxcredential-accessfile-uploadprivescgit-internalshttps://louizi-yassine.vercel.app/writeups/hacker-holidays-day11/https://louizi-yassine.vercel.app/writeups/hacker-holidays-day11/The same unsanitised shell=True command injection shows up twice on this box — first as a low-priv foothold via a "connectivity check" tool, then again in a root-owned automation service reached by pivoting through internal-only FreePBX and Chisel tunnels.Thu, 06 Aug 2026 00:00:00 GMTTryHackMehacker-holidayscommand-injectionpivotingpriveschttps://louizi-yassine.vercel.app/writeups/fireflow/https://louizi-yassine.vercel.app/writeups/fireflow/An unauthenticated Langflow RCE (CVE-2026-33017) leads to leaked superuser credentials via process environment, password reuse for user access, a JWT alg:none forgery against a custom MCP server, and finally a Kubernetes nodes/proxy verb bypass to a privileged pod for host root.Wed, 05 Aug 2026 00:00:00 GMTHackTheBoxrcejwtkubernetesprivescpassword-reusehttps://louizi-yassine.vercel.app/writeups/hacker-holidays-day10/https://louizi-yassine.vercel.app/writeups/hacker-holidays-day10/A zip-slip flaw in a staff upload feature lets an extracted archive entry escape its per-upload folder and overwrite the app's own live Jinja template, turning a simple file upload into persistent SSTI/RCE.Wed, 05 Aug 2026 00:00:00 GMTTryHackMehacker-holidayszip-slipsstifile-uploadhttps://louizi-yassine.vercel.app/writeups/cap/https://louizi-yassine.vercel.app/writeups/cap/A "Security Snapshot" dashboard lets any user page through other users' packet captures by ID — one of them leaks an FTP password reused for SSH, and a stray Linux capability on python3.8 hands over root instantly.Tue, 04 Aug 2026 00:00:00 GMTHackTheBoxidorpcap-analysislinux-capabilitiespriveschttps://louizi-yassine.vercel.app/writeups/hacker-holidays-day9/https://louizi-yassine.vercel.app/writeups/hacker-holidays-day9/An Azure static website leaks an over-scoped account SAS token, which exposes a hidden storage container holding service-principal credentials — and from there, a Key Vault secret whose "rotated" value is still recoverable in its previous version.Tue, 04 Aug 2026 00:00:00 GMTTryHackMehacker-holidaysazurecloudsas-tokenkey-vaulthttps://louizi-yassine.vercel.app/writeups/hacker-holidays-day8/https://louizi-yassine.vercel.app/writeups/hacker-holidays-day8/A crypto rewards app rate-limits its daily claim to once per 24h, but the check-then-act isn't atomic — firing 30 parallel requests with Burp's last-byte sync lets every one of them win the race.Mon, 03 Aug 2026 00:00:00 GMTTryHackMehacker-holidaysrace-conditionbusiness-logichttps://louizi-yassine.vercel.app/writeups/hacker-holidays-day7/https://louizi-yassine.vercel.app/writeups/hacker-holidays-day7/A NoSQL injection auth bypass leads to an EJS SSTI RCE, then an exposed Node --inspect debugger and disk-group membership chain all the way to a raw block-device read of root.txt.Sun, 02 Aug 2026 00:00:00 GMTTryHackMehacker-holidaysnosql-injectionsstipriveschttps://louizi-yassine.vercel.app/writeups/hacker-holidays-day6/https://louizi-yassine.vercel.app/writeups/hacker-holidays-day6/A screenshotted chat reveals an email address and a hint about a "free profile linker starting with G" — hashing the email for Gravatar and pulling its JSON profile surfaces a hidden bio with the flag.Sat, 01 Aug 2026 00:00:00 GMTTryHackMehacker-holidaysosinthttps://louizi-yassine.vercel.app/writeups/wreath/https://louizi-yassine.vercel.app/writeups/wreath/A three-host network pivot: a Webmin RCE foothold, chisel/socat relays into an isolated GitStack server and a personal PC, a leaked git repo revealing a file-upload webshell, PHP payload obfuscation for AV evasion, and an unquoted-service-path privesc to SYSTEM.Sat, 01 Aug 2026 00:00:00 GMTTryHackMepivotingav-evasionprivescrcecredential-accesshttps://louizi-yassine.vercel.app/writeups/hacker-holidays-day5/https://louizi-yassine.vercel.app/writeups/hacker-holidays-day5/Demo creds in an HTML comment lead to an unsafe YAML deserialization RCE in a playlist importer, then a root password exposed in plain process arguments gets reused directly for su root.Fri, 31 Jul 2026 00:00:00 GMTTryHackMehacker-holidaysinsecure-deserializationprivesccredential-accesshttps://louizi-yassine.vercel.app/writeups/hacker-holidays-day4/https://louizi-yassine.vercel.app/writeups/hacker-holidays-day4/A PCAP shows a covert channel exfiltrating one byte per HTTP request inside a Cookie header — base64 plus a single-byte XOR, broken instantly with a known-plaintext crib on the flag format.Thu, 30 Jul 2026 00:00:00 GMTTryHackMehacker-holidaysforensicsnetwork-forensicshttps://louizi-yassine.vercel.app/writeups/hacker-holidays-day3/https://louizi-yassine.vercel.app/writeups/hacker-holidays-day3/A "free" wellness app hands out unauthenticated Cognito guest credentials, and an over-scoped IAM role lets those guest credentials Scan the entire DynamoDB table instead of just one record.Wed, 29 Jul 2026 00:00:00 GMTTryHackMehacker-holidayscloudawsidorhttps://louizi-yassine.vercel.app/writeups/hacker-holidays-day2/https://louizi-yassine.vercel.app/writeups/hacker-holidays-day2/A Flask app leaves .git/ reachable — git-dumper reconstructs the full repo, and a "remove before launch" note in the staging README hands over the flag directly.Tue, 28 Jul 2026 00:00:00 GMTTryHackMehacker-holidayswebsource-code-disclosurehttps://louizi-yassine.vercel.app/writeups/hacker-holidays-day1/https://louizi-yassine.vercel.app/writeups/hacker-holidays-day1/An LLM hotel concierge gates its system prompt behind guest "trust" rather than real auth — claiming a recognized name plus asking it to reveal its instructions dumps the whole prompt, escalation code included.Mon, 27 Jul 2026 00:00:00 GMTTryHackMehacker-holidaysllm-securityprompt-injectionhttps://louizi-yassine.vercel.app/writeups/you-got-mail/https://louizi-yassine.vercel.app/writeups/you-got-mail/OSINT-harvested employee emails feed a credential spray against an hMailServer instance, and the resulting SMTP access is used to phish a reverse-shell payload straight to the mail server itself.Sat, 25 Jul 2026 00:00:00 GMTTryHackMeosintphishingcredential-accesspriveschttps://louizi-yassine.vercel.app/writeups/htb-password-attacks-skills-assessment/https://louizi-yassine.vercel.app/writeups/htb-password-attacks-skills-assessment/Chained credential attacks across a segmented AD network: SSH user enumeration, cleartext creds in a Password Safe backup, a SOCKS pivot through a jump host, and an LSASS dump feeding a DCSync.Fri, 24 Jul 2026 00:00:00 GMTHackTheBoxactive-directorypassword-attackscredential-accesspivotinghttps://louizi-yassine.vercel.app/writeups/interceptor/https://louizi-yassine.vercel.app/writeups/interceptor/Two-factor login bypassed via OTP mass assignment (brute force also works, but was not the intended path), then a curl-injection bug in a feed importer used to read /var/www/user.txt off the box.Fri, 24 Jul 2026 00:00:00 GMTTryHackMewebmass-assignmentbrute-forcercehttps://louizi-yassine.vercel.app/writeups/ironhold/https://louizi-yassine.vercel.app/writeups/ironhold/White-box Java Spring app: hardcoded/actuator-leaked credentials, a UNION-based SQL injection, mass-assignment privilege escalation to WARDEN, and a commons-collections gadget chain for RCE.Thu, 23 Jul 2026 00:00:00 GMTTryHackMewebsql-injectiondeserializationprivescsource-code-reviewhttps://louizi-yassine.vercel.app/writeups/operation-endgame/https://louizi-yassine.vercel.app/writeups/operation-endgame/Active Directory chain: guest-account Kerberoasting, password reuse, a targeted Kerberoast via GenericWrite, and hardcoded creds in a PowerShell script leading to a SYSTEM shell.Fri, 17 Jul 2026 00:00:00 GMTTryHackMeactive-directorykerberoastingpassword-sprayingpriveschttps://louizi-yassine.vercel.app/writeups/boot2root-rickmorty/https://louizi-yassine.vercel.app/writeups/boot2root-rickmorty/A CeWL-generated wordlist cracks Joomla admin, template editing gets a reverse shell, and hardcoded credentials in an automation script complete a sudo (ALL:ALL) escalation to root.Wed, 03 Jun 2026 00:00:00 GMTVulnHubwebcmsprivesccredential-accesshttps://louizi-yassine.vercel.app/writeups/dc-1/https://louizi-yassine.vercel.app/writeups/dc-1/Drupalgeddon2 (CVE-2018-7600) gets an in-memory shell via Metasploit, then a SUID find binary hands over root through a one-line GTFOBins exploit.Sat, 11 Apr 2026 00:00:00 GMTVulnHubwebcmsrcepriveschttps://louizi-yassine.vercel.app/writeups/venom/https://louizi-yassine.vercel.app/writeups/venom/An MD5 hash in a page comment cracks FTP access, a hint file and a Vigenère cipher unlock a CMS admin panel, and a known Subrion CMS RCE leads to root via a hardcoded backup password.Sat, 11 Apr 2026 00:00:00 GMTVulnHubwebcmsrcecryptographycredential-access