skip to content
01 SITE A3 // SHAFT-07 · DESCENT ACTIVE

we don't find the door. we are already inside.

JUNIOR PENETRATION TESTER @ WISESECURITY 12 FILES RECOVERED HTB PROFESSIONAL · LVL 55 OSCP+ / OSCP / eJPT SEASON 11 · SILVER · #4824 155 SEASON POINTS · 6/26 FLAGS 2 RESEARCH PAPERS WE DON'T FIND THE DOOR. WE ARE ALREADY INSIDE.
02

THE STRATA

Three files, cut from the sediment at the depth they were found.

EXCAVATION CATALOG →
  1. №012 PG

    Vault

    Guest SMB write access exploited via malicious LNK file to capture NTLMv2 hash; cracked for WinRM foothold, then GenericWrite on Default Domain Policy abused with SharpGPOAbuse for admin.

    HARD
  2. №011 HTB

    Editor

    Exploiting XWiki (CVE-2025-24893) for RCE and privilege escalation via SUID abuse on ndsudo (CVE-2024-32019).

    EASY
  3. №010 PG

    Resourced

    Credentials leaked in LDAP description field give access to ntds.dit backup; hashes dumped for WinRM foothold, then RBCD attack via GenericWrite on DC for SYSTEM.

    MEDIUM
03

THE CHAMBER

Bottom of the shaft. What is buried deepest is worth the most.

CVE-2025-55182

React2Shell

Complete technical analysis of CVE-2025-55182 (React2Shell): insecure deserialization in the RSC Flight protocol of React 19 enabling pre-auth RCE with CVSS 10.0.

open the record →
research →
VISAGE // IN CIPHER PGP FINGERPRINT · DRUNKEN BISHOP
04

THE OPERATOR

Whoever did the digging.

aeth3ron

offensive security operator · OSCP+

role
Junior Penetration Tester · WiseSecurity
certs
OSCP+ · OSCP · eJPT
htb
Professional · Lvl 55
base
Madrid, Spain · remote
the full dossier →
// FIELD DISPATCHES

New recovered files, straight to your inbox. No noise.