Pytho.
Security research and bug bounty.
This is where I keep my Hack The Box writeups.
What lives here.
I'm Pytho. I practice security research and bug bounty. Here I publish routes through Hack The Box machines and keep links to my profiles, certificates and PGP key.
11published writeups
03platform profiles
01certificate held
Certificates.
The one I've earned, and the one I'm working towards.
Writeups.
Full routes through Hack The Box machines. Newest first.
01 Authority HTB: Ansible vault secrets on a guest SMB share, a PWM instance in configuration mode that hands over an LDAP bind in cleartext, and ESC1 through a machine account we add ourselves. 02 Voleur HTB: Kerberos-only auth, a cracked Excel sheet leaking service account passwords, targeted Kerberoasting, a restored deleted user whose DPAPI credentials unlock the next account, and an NTDS backup reached through WSL. 03 Pov HTB: an LFI on an ASP.NET file parameter leaks web.config and its machine keys, a ViewState deserialization gives RCE, a saved PSCredential unlocks the next user, and SeDebugPrivilege gets migrated into a SYSTEM process. 04 Postman HTB: an unauthenticated Redis lets me write an SSH key for RCE as redis, linpeas finds Matt's encrypted id_rsa which cracks to a password, then a Webmin 1.910 packageup RCE gives root. 05 Trick HTB: a DNS zone transfer leaks a payroll vhost, SQL injection with FILE privilege reads files off disk, then LFI plus Nginx log poisoning on a second vhost gives a shell as michael, and a sudo fail2ban action hijack finishes it as root. 06 Jeeves HTB: an unauthenticated Jenkins Script Console for RCE, then SeImpersonatePrivilege into SYSTEM with JuicyPotato, and a root flag hidden in an alternate data stream. 07 TombWatcher HTB: targeted Kerberoasting, a gMSA password read, WriteOwner abuse and a resurrected cert_admin for ADCS ESC15. 08 Media HTB: an .asx playlist that leaks an NTLM hash, a directory junction into the web root, and GodPotato. 09 Administrator HTB: a password reset chain, a Password Safe backup over FTP, Kerberoasting and DCSync. 10 Fluffy HTB: SMB write access, CVE-2025-24071, shadow credentials and ADCS ESC16. 11 Hello World My first post :)
Elsewhere.
My profiles on security platforms.
Send a message.
PGP public keyEncrypted contact
Encrypt anything that should not sit in a mailbox in plain text. Verify the fingerprint before trusting the key.
- Fingerprint
- 9524 4C9B 78A5 2294 2AD2 7BBE 8B59 4AA5 A772 713D
- Algorithm
- rsa3072
- Valid
- 2026-07-09 → 2027-07-09
curl -s https://pytho0.day/pgp.asc | gpg --import
-----BEGIN PGP PUBLIC KEY BLOCK----- mQGNBGpPbaQBDADcz1iihvtbnQlyFQGUmF6mvmokvpDdjm8d+C8NDEKHr9ikrlO1 836MNzTT6exVY5xm0AIRGfouAtYRnmzU8rJM8bW9IfAjnMYJwWSCBg44QWdAB5fW yoyaJog7oDjVb6DQb0yrwaamMd1kzoDKAukMrdBIGI0J4b2xDiFcKc/dp/TzCXNZ 0NYnXHioy8jxQ2UA1kIUB/K8QJRUTnJQlDK89/PdezpJXS31KFgBQ1cZ48K5Sifb Cs0txRGJCYwsOayA3zCj9yRXTO4CkNCbG8GyKSuJOdTMadOq1eT2zNSwW+QWM7dN Wj1H75yP1oW/H9/5QCarImY/rsbAUMJJv2Xp5ys7C/JOrw3uoI3DQwkHAMcRCEOc RSBb1dd84HCY4n/dQa9UKH3/IAATPQq+uWAmZURw/eOjwj+Ba8nIQxfOHRbAhhqn +cjZ65U6g51OQ60CYFvuxZ+CHCccrdKrMEFes5KU64TBpZhEJw3XgbjhKMWkOMJT 6uvDniSPxvOdoFcAEQEAAbQZUHl0aG8gPHB5dGhvMTNAcHJvdG9uLm1lPokB1AQT AQoAPhYhBJUkTJt4pSKUKtJ7votZSqWncnE9BQJqT22kAhsDBQkB4TOABQsJCAcC BhUKCQgLAgQWAgMBAh4BAheAAAoJEItZSqWncnE9W6YMAIiQrUqJwxKIcIjMoxp4 F19UqSSK9J+WQclPdixD7O2YPLtylZ4OscSCCg7mo+/VZ4RGzVVaaP9Kf9rTcMOU x4CuZlIcJemoSoIUl9FF2Mhp0nfMrFM4aUyypH0HCQYYNoKG8XhWTAB3YfNpWY1X +ndVXHy4NePOzUp+qvcDnaS7S2v41bMPv+oIImamIF8EsKRPEu6zEsyqESbWLUSB 6xZwJG2AXGl4q2/ablOc2K5/yDQyLJMfi0qO9yphCN49h94uJjgLUx7q9Pk7R/YT gkuQr482NMfObhL1G+3IlncFYkh/eictWzhMEn2AKfICI9LcFgHXIOAkZputn6MA F8ktTAsO+PByQzOW2jehjcsvlIcomKxDDKEu5ne3wqyyEOT4T5WexKmfVRxOe2uj QtPOgBOl+QVDCr5Pto9aRsxGiVGOf0u2Dj35OCN+ZnADlma9UokqQmnx3SaCRXJW bqRUW2ybnoVia3UKVghz9BTn9hCoPONKvmseMeaWhcH9ybkBjQRqT22kAQwA71Eq lDKAGBSpJETwBCQVPcy684NLbAZDd62Va9y1/TFWbP8lTaelOhn+7h6Af3jUa6pT JgdcTJ6JRu40FE0feUDRMTXQD8eMZIiEFhAX70yH+HSfOMB+P3/iLEYsyMukPfjl 2FPbVvBDxnyeK0CyBruaCIE4U7x1MoDImJ2Usj4OayN51wMGqjVbRsF93FYRaEbZ QG9+JPZc4AdK+ViHI5WLOKJOE/1spasz261VN1A6dtB3eve62jGkMmoAhdso6OPx 5QIosNGoIvBAP/8QFs3omRrMX2NBWouKRPfB5Ux1nWauATJNDssbI5N1cmaT5H1e OdCRGMHFw4KBnbwBr0zt+5qi8i498Y95+KDBZJLIbGdS49PJF2Jy5X/+kWDENt+y 0PXYsyh65tHvwJATBNr27Vw9bYU9l52J/2agGpTBh0bxamEU0M0bt4DmR/+Xq0W8 eC8/UDaze7JxZjRQzp1y2rRD6+1cFpQ8dx/Av0ZwISoplentMj7MYzBP3b8DABEB AAGJAbwEGAEKACYWIQSVJEybeKUilCrSe76LWUqlp3JxPQUCak9tpAIbDAUJAeEz gAAKCRCLWUqlp3JxPWSTC/9sYNpCAXWBYm/zS5NGk52OCEwvqJHRDvrmShdMdgug SGZEql4a0FURLXDDvxWkfoRDFq1KMDpgtC2iAWO59xXpvTsf4GXtScgB9EelDveh AV3UI3pOXS6F6myxUVIK9R/chIHei84EuJNBrFV6+hc098wvMGk9dDUCLEiUb4z3 K+4kW1Z5QvvcIf8RgITkJjgMKF1bKpWYycE+fQ//mWKpGPeq9RojmeF+KPCz7bZ+ c0oJwTCwlrgKh0CVOu0Fjqm0XekeqnzZ79qXLc4m1h+lLtx92GGBVqg9FTvPodmQ 1h9lpmO7pRYg+9MzwLwEarF1+EFvzfEwUP5Ssq0Ip4gFc0CwodPRRoY4w10E3PMN X6qnDxRZdXV1ljT4vIsml6It4xFuAz83ODzCWNZLUuYo+Qklm6zbS3X3WcnA4DO/ UqHBcqyfMtItRUlTa3jLmWbzVGD1UVeVCXgODeRpr/9a3HOK3CHq3ToO4SWvAr08 oVMJP7mHff8Jftzug3n9adw= =3V5X -----END PGP PUBLIC KEY BLOCK-----