https://x3ric.com/blog/tags/rce/CTF notes, systems work, and writeups.Hugoen-usSat, 06 Jun 2026 21:41:13 +0200https://x3ric.com/blog/posts/HackTheBox-CachedWeb-Challenge/https://x3ric.com/blog/posts/HackTheBox-CachedWeb-Challenge/Tue, 23 Sep 2025 00:20:00 +0800challengehtbwebssrfpath-traversalfile-uploadrceflaskCachedWeb: chain SSRF with path control to reach the internal target and read the flag.https://x3ric.com/blog/posts/HackTheBox-Amidst-Us-Challenge/https://x3ric.com/blog/posts/HackTheBox-Amidst-Us-Challenge/Fri, 28 Feb 2025 00:20:00 +0800challengehtbwebrceAmidst Us: find the command execution path, trigger it cleanly, and read the flag.https://x3ric.com/blog/posts/HackTheBox-Letter-Dispair-Challenge/https://x3ric.com/blog/posts/HackTheBox-Letter-Dispair-Challenge/Fri, 28 Feb 2025 00:20:00 +0800challengehtbwebrcephpcve-2016-10045Letter Dispair: find the command execution path, trigger it cleanly, and read the flag.https://x3ric.com/blog/posts/HackTheBox-Interstellar-Challenge/https://x3ric.com/blog/posts/HackTheBox-Interstellar-Challenge/Fri, 24 Jan 2025 00:20:00 +0800challengehtbwebsql-injectionssrfrcephpEnter the challenge flag to unlock this writeup.https://x3ric.com/blog/posts/HackTheBox-Breathtaking-View-Challenge/https://x3ric.com/blog/posts/HackTheBox-Breathtaking-View-Challenge/Thu, 12 Dec 2024 09:20:00 +0800challengehtbwebtemplate-injectionrceEnter the challenge flag to unlock this writeup.https://x3ric.com/blog/posts/HackTheBox-Pentest-Notes-Challenge/https://x3ric.com/blog/posts/HackTheBox-Pentest-Notes-Challenge/Thu, 12 Dec 2024 09:20:00 +0800challengehtbwebsql-injectionrceEnter the challenge flag to unlock this writeup.https://x3ric.com/blog/posts/HackTheBox-ScreenCrack-Challenge/https://x3ric.com/blog/posts/HackTheBox-ScreenCrack-Challenge/Tue, 03 Dec 2024 09:20:00 +0800challengehtbwebssrfrcephpEnter the challenge flag to unlock this writeup.https://x3ric.com/blog/posts/HackTheBox-C.O.P-Challenge/https://x3ric.com/blog/posts/HackTheBox-C.O.P-Challenge/Sat, 30 Nov 2024 09:20:00 +0800challengehtbwebsql-injectiondeserializationrceC.O.P: exploit the SQL injection, extract the needed data, and reach the flag.https://x3ric.com/blog/posts/HackTheBox-Toxic-Challenge/https://x3ric.com/blog/posts/HackTheBox-Toxic-Challenge/Sat, 30 Nov 2024 09:20:00 +0800challengehtbwebdeserializationrcephpToxic: abuse unsafe deserialization to cross the trust boundary and reach the flag.