ctf-writeup-lookup

name	CTF Writeup Lookup
description	This skill should be used when stuck on a CTF challenge or when the user asks to look up a writeup. Use EARLY when brute forcing or guessing seems like the only option - writeups often reveal the intended path. Trigger on: "look up writeup", "how do others solve", "stuck", "what's the intended path", machine names like "Soulmate", "Headless".
version	1.0.0

CTF Writeup Lookup Skill

When to Use

Use this skill EARLY when:

• You've been stuck for more than 10-15 minutes
• The only remaining option seems to be brute forcing
• You find an unusual service with no obvious exploit
• User explicitly asks for writeup
• Machine name is known (search: "HTB <machine_name> writeup")

Search Strategies

HackTheBox Machines

# Primary search
"HackTheBox <machine_name> writeup"
"HTB <machine_name> walkthrough"

# With service focus
"HTB <machine_name> <service> exploit"
"HackTheBox <machine_name> privilege escalation"

TryHackMe Rooms

"TryHackMe <room_name> writeup"
"THM <room_name> walkthrough"

Generic CTF

"<ctf_name> <challenge_name> writeup"
"<challenge_name> CTF solution"

Quality Sources

Tier 1 (Most Reliable)

• 0xdf.gitlab.io - Detailed, well-explained
• ippsec.rocks - Video walkthroughs with transcripts
• HackTheBox Official - After machine retires

Tier 2 (Good Coverage)

• Medium.com - Many writeups, variable quality
• infosecwriteups.com - Curated content
• GitHub repos - Often have exploit scripts

Tier 3 (Quick Reference)

• YouTube - Visual walkthroughs
• Personal blogs - May have unique approaches

What to Extract from Writeups

Initial Access

• Exact CVE or vulnerability used
• Exploit command/script
• Credentials found
• Service-specific tricks

Privilege Escalation

• Exact technique (SUID, cron, capability, etc.)
• Password/key locations
• Service misconfigurations
• Intended vs unintended paths

Key Information Template

## Writeup Summary: <Machine Name>

### Initial Access
- **Vector**: <CVE/technique>
- **Service**: <service name and version>
- **Exploit**: <command or script>
- **Creds Found**: <username:password if any>

### User Privilege Escalation
- **From**: <initial user>
- **To**: <target user>
- **Method**: <technique>
- **Key Finding**: <password location, config file, etc.>

### Root Privilege Escalation
- **Method**: <technique>
- **CVE**: <if applicable>
- **Key Finding**: <what to look for>

### Credentials Discovered
| Username | Password | Source |
|----------|----------|--------|
| <user> | <pass> | <where found> |

### Files to Check
- <path/to/important/file>
- <another/key/location>

Search Examples

Example: Stuck on CrushFTP

Search: "CrushFTP CVE 2025 authentication bypass"
Search: "CrushFTP HTB exploit"
Search: "CrushFTP penetration testing"

Example: Unknown Service on Port 2222

Search: "SSH port 2222 not OpenSSH exploit"
Search: "Erlang SSH CVE"
Search: "port 2222 4369 Erlang exploitation"

Example: Need Password for User

Search: "HTB <machine> <username> password"
Search: "HackTheBox <machine> user flag"
Search: "<machine> grep password config"

Automation

Quick Writeup Search Script

#!/bin/bash
MACHINE="$1"
echo "Searching for writeups..."
echo ""
echo "=== 0xdf ==="
curl -s "https://0xdf.gitlab.io/" | grep -i "$MACHINE" | head -5
echo ""
echo "=== Search queries to try ==="
echo "1. HTB $MACHINE writeup site:medium.com"
echo "2. HackTheBox $MACHINE walkthrough"
echo "3. $MACHINE privilege escalation HTB"

Integration with Workflow

When invoking this skill:

1. Identify what you're stuck on

   • Initial access?
   • Lateral movement?
   • Privilege escalation?

2. Search with context

   • Include service names
   • Include version numbers
   • Include error messages

3. Extract actionable steps

   • Don't just read - create commands
   • Note exact file paths
   • Copy credentials exactly

4. Verify against target

   • Writeups may be for different versions
   • Paths/usernames may differ
   • Adapt techniques to your situation