AboutWriteupsTradecraftContact

Writeups

CTF walkthroughs, CVE analysis, and malware teardowns.

SHub Stealer - Dissecting the Second Stage AppleScript Payload
Malware-Analysis

SHub Stealer - Dissecting the Second Stage AppleScript Payload

Breakdown of SHub Stealer's payload.applescript covering the credential harvest loop, browser and wallet collection architecture, chunked exfiltration logic, app.asar injection, and persistence mechanism.

#macos#infostealer#applescript#reverse-engineering#shub#malware-analysis
Hunting SHub: Intercepting a Live macOS Infostealer Campaign
ThreatHunting

Hunting SHub: Intercepting a Live macOS Infostealer Campaign

By exploiting a misconfigured C2 backend, I intercepted the exfiltration pipeline of an active SHub Stealer campaign, extracted victim telemetry, and burned previously unreported infrastructure — including a new C2 domain and confirmed wallet backdoor endpoint.

#macos#infostealer#malware#threat-intel#threatHunting#applescript#clickfix#shub
Overwatch — HackTheBox
CTF

Overwatch — HackTheBox

Active Directory exploitation chain covering SMB share enumeration, .NET binary decompilation, MSSQL linked server abuse, ADIDNS poisoning, NTLMv2 capture, and SOAP-based command injection for SYSTEM via a custom monitoring service.

#hackthebox#active-directory#mssql#adidns#ntlm#dotnet#soap#windows
PG-Practice — Emporium
CTF

PG-Practice — Emporium

PHP Object Injection via unsafe deserialization chained with Zip Slip for privilege escalation to root.

#php#deserialization#zip-slip#linux#privesc
CVE-2025-27636 — Apache Camel Header Casing RCE
CTF

CVE-2025-27636 — Apache Camel Header Casing RCE

Unauthenticated RCE via improper HTTP header normalization in Apache Camel's exec component, allowing filter bypass through mixed-case header names.

#cve#apache-camel#rce#header-injection#java