| name | CTF Writeup Lookup |
| description | This skill should be used when stuck on a CTF challenge or when the user
asks to look up a writeup. Use EARLY when brute forcing or guessing
seems like the only option - writeups often reveal the intended path.
Trigger on: "look up writeup", "how do others solve", "stuck",
"what's the intended path", machine names like "Soulmate", "Headless".
|
| version | 1.0.0 |
CTF Writeup Lookup Skill
When to Use
Use this skill EARLY when:
- You've been stuck for more than 10-15 minutes
- The only remaining option seems to be brute forcing
- You find an unusual service with no obvious exploit
- User explicitly asks for writeup
- Machine name is known (search: "HTB <machine_name> writeup")
Search Strategies
HackTheBox Machines
# Primary search
"HackTheBox <machine_name> writeup"
"HTB <machine_name> walkthrough"
# With service focus
"HTB <machine_name> <service> exploit"
"HackTheBox <machine_name> privilege escalation"
TryHackMe Rooms
"TryHackMe <room_name> writeup"
"THM <room_name> walkthrough"
Generic CTF
"<ctf_name> <challenge_name> writeup"
"<challenge_name> CTF solution"
Quality Sources
Tier 1 (Most Reliable)
- 0xdf.gitlab.io - Detailed, well-explained
- ippsec.rocks - Video walkthroughs with transcripts
- HackTheBox Official - After machine retires
Tier 2 (Good Coverage)
- Medium.com - Many writeups, variable quality
- infosecwriteups.com - Curated content
- GitHub repos - Often have exploit scripts
Tier 3 (Quick Reference)
- YouTube - Visual walkthroughs
- Personal blogs - May have unique approaches
What to Extract from Writeups
Initial Access
- Exact CVE or vulnerability used
- Exploit command/script
- Credentials found
- Service-specific tricks
Privilege Escalation
- Exact technique (SUID, cron, capability, etc.)
- Password/key locations
- Service misconfigurations
- Intended vs unintended paths
Key Information Template
## Writeup Summary: <Machine Name>
### Initial Access
- **Vector**: <CVE/technique>
- **Service**: <service name and version>
- **Exploit**: <command or script>
- **Creds Found**: <username:password if any>
### User Privilege Escalation
- **From**: <initial user>
- **To**: <target user>
- **Method**: <technique>
- **Key Finding**: <password location, config file, etc.>
### Root Privilege Escalation
- **Method**: <technique>
- **CVE**: <if applicable>
- **Key Finding**: <what to look for>
### Credentials Discovered
| Username | Password | Source |
|----------|----------|--------|
| <user> | <pass> | <where found> |
### Files to Check
- <path/to/important/file>
- <another/key/location>
Search Examples
Example: Stuck on CrushFTP
Search: "CrushFTP CVE 2025 authentication bypass"
Search: "CrushFTP HTB exploit"
Search: "CrushFTP penetration testing"
Example: Unknown Service on Port 2222
Search: "SSH port 2222 not OpenSSH exploit"
Search: "Erlang SSH CVE"
Search: "port 2222 4369 Erlang exploitation"
Example: Need Password for User
Search: "HTB <machine> <username> password"
Search: "HackTheBox <machine> user flag"
Search: "<machine> grep password config"
Automation
Quick Writeup Search Script
#!/bin/bash
MACHINE="$1"
echo "Searching for writeups..."
echo ""
echo "=== 0xdf ==="
curl -s "https://0xdf.gitlab.io/" | grep -i "$MACHINE" | head -5
echo ""
echo "=== Search queries to try ==="
echo "1. HTB $MACHINE writeup site:medium.com"
echo "2. HackTheBox $MACHINE walkthrough"
echo "3. $MACHINE privilege escalation HTB"
Integration with Workflow
When invoking this skill:
-
Identify what you're stuck on
- Initial access?
- Lateral movement?
- Privilege escalation?
-
Search with context
- Include service names
- Include version numbers
- Include error messages
-
Extract actionable steps
- Don't just read - create commands
- Note exact file paths
- Copy credentials exactly
-
Verify against target
- Writeups may be for different versions
- Paths/usernames may differ
- Adapt techniques to your situation
