PullSec's Note

RustyKey was a bit more technical and required a deeper understanding of how systems interact under the hood. I appreciated how each step built on the previous one, making the whole exploitation chain feel very logical. Some parts took time to fully understand, but that’s what made it satisfying in the end. It’s definitely a machine that helped me improve my troubleshooting and analysis skills.

Fluffy was a fun machine that required a good balance between enumeration and intuition. Nothing was overly complex, but small details made a big difference in progressing. I particularly enjoyed how the box forced me to slow down and really pay attention to the environment instead of rushing. It’s the kind of challenge that reinforces good habits rather than relying on brute force or automated tools.

Artificial was a really interesting one. At first glance, it looked like a simple web application, but the use of TensorFlow models immediately caught my attention. I hadn’t worked much with machine learning attack surfaces before, so digging into model deserialization vulnerabilities was both challenging and rewarding. Reproducing the environment locally with Docker helped me understand the behavior much better, and it felt great to turn that into a working RCE. Overall, this box was a solid reminder that modern technologies often introduce new and less obvious attack vectors.

LeHack, one of the biggest cybersecurity events in Europe, had been on my radar for quite some time.

Over time, while working on my blog and documenting cybersecurity, homelab, and infrastructure projects, I realized that writing content was only one part of the process.

I created this blog to document what I build, what I break, and what I learn along the way.