THM: Hollow Shell
Web challenge exploiting a ZIP-based asset upload through magic-byte forgery and a Zip Slip path traversal to plant a malicious Gunicorn hook.
Path Traversal
HTB: Mailing
Windows box abusing a path-traversal bug in hMailServer for credentials, capturing NTLM via a crafted email, and executing code through LibreOffice.