Elnur Badalov's personal blog. I hack, automate and self-host, and I write about security, Linux and infrastructure.https://elnurbda.com/Wed, 07 Oct 2026 19:31:08 GMThttps://elnurbda.com/posts/65-ai-becomes-i/https://elnurbda.com/posts/65-ai-becomes-i/An essay on AI shifting the 'I' leftward: its effect on IT careers, society, and why Asimov's science fiction is becoming reality.Wed, 07 Oct 2026 19:31:08 GMThttps://elnurbda.com/posts/64-productivity/https://elnurbda.com/posts/64-productivity/How I organize my life for productivity - note-taking, todos, a calendar, a diary, plain-text accounting, and Linux.Tue, 25 Aug 2026 17:05:01 GMThttps://elnurbda.com/posts/63-hcvao/https://elnurbda.com/posts/63-hcvao/HashiCorp Certified: Vault Associate (003) exam review - how I studied, which resources worked, and what the exam itself is like.Fri, 14 Aug 2026 19:52:25 GMThttps://elnurbda.com/posts/62-ledger-cli/https://elnurbda.com/posts/62-ledger-cli/Why I log every transaction in one plain text file with Ledger CLI: double-entry basics, the account tree, multi-currency metals and stocks, daily queries.Fri, 24 Jul 2026 17:18:38 GMThttps://elnurbda.com/posts/61-nixos-openbao-ha/https://elnurbda.com/posts/61-nixos-openbao-ha/Build a declarative NixOS control plane that deploys a fleet over SSH, then run OpenBao on it - single node first, then a raft HA cluster.Tue, 21 Jul 2026 02:00:00 GMThttps://elnurbda.com/posts/60-vault-autounseal-ldap/https://elnurbda.com/posts/60-vault-autounseal-ldap/HashiCorp Vault auto-unseal (Azure HSM + Transit), LDAP auth mapped to team policies, and a KV v2 ACL design - a hands-on three-VM lab.Tue, 14 Jul 2026 15:00:00 GMThttps://elnurbda.com/posts/59-openbao-gitlab/https://elnurbda.com/posts/59-openbao-gitlab/Five ways to get secrets into a deployed app with GitLab CI and OpenBao (Vault), from plain .env files to JWT/AppRole auth, a Vault Agent on the host, and live SDK fetches, plus the full self-hosted GitLab and OpenBao setup.Sat, 13 Jun 2026 14:08:32 GMThttps://elnurbda.com/posts/58-cka/https://elnurbda.com/posts/58-cka/An honest CKA exam review covering what it really takes to pass - from hands-on lab practice to the resources and mindset that actually make the difference.Tue, 31 Mar 2026 14:22:00 GMThttps://elnurbda.com/posts/57-pg-ctf-jacko/https://elnurbda.com/posts/57-pg-ctf-jacko/Proving Grounds CTF - Jacko. H2 database misconfiguration, RCE, and DLL hijacking in PaperStream IP.Thu, 22 Jan 2026 12:46:00 GMThttps://elnurbda.com/posts/56-pg-ctf-internal/https://elnurbda.com/posts/56-pg-ctf-internal/Proving Grounds Internal write-up: very old Windows Server 2008 box where we find SMBv2 CVE-2009-3103 with nmap and use Metasploit to pop a SYSTEM meterpreter.Thu, 22 Jan 2026 12:45:00 GMThttps://elnurbda.com/posts/55-pg-ctf-dvr4/https://elnurbda.com/posts/55-pg-ctf-dvr4/Proving Grounds DVR4 write-up: use Argus DVR path traversal to steal SSH keys and flags, then break its weak password encryption to log in as Administrator on the host.Thu, 22 Jan 2026 12:44:00 GMThttps://elnurbda.com/posts/54-pg-ctf-authby/https://elnurbda.com/posts/54-pg-ctf-authby/Proving Grounds CTF - Authby. Anonymous FTP, credential deduction, and MS11-046 privilege escalation.Thu, 22 Jan 2026 12:43:00 GMThttps://elnurbda.com/posts/53-pg-ctf-algernon/https://elnurbda.com/posts/53-pg-ctf-algernon/Proving Grounds Algernon write-up: exploit the SmarterMail Build 6985 RCE bug on port 9998 to get a SYSTEM shell on Windows with almost no extra steps.Thu, 22 Jan 2026 12:42:00 GMThttps://elnurbda.com/posts/52-pg-ctf-vault/https://elnurbda.com/posts/52-pg-ctf-vault/Proving Grounds Vault write-up: drop a malicious URL/SCF file into a writable SMB share, capture a domain user hash, get a WinRM shell and abuse SeRestorePrivilege with Utilman.Thu, 22 Jan 2026 12:41:00 GMThttps://elnurbda.com/posts/51-pg-ctf-resourced/https://elnurbda.com/posts/51-pg-ctf-resourced/Proving Grounds Resourced: domain recon, password spraying, dumping LSA secrets, and abusing Resource-Based Constrained Delegation (RBCD) to compromise the host.Thu, 22 Jan 2026 12:40:00 GMThttps://elnurbda.com/posts/50-pg-ctf-nagoya/https://elnurbda.com/posts/50-pg-ctf-nagoya/Proving Grounds Nagoya: SMB and MSSQL enumeration, Kerberoasting a service account, forging a Silver Ticket, and abusing impersonation tokens to land SYSTEM.Thu, 22 Jan 2026 12:39:00 GMThttps://elnurbda.com/posts/49-pg-ctf-hutch/https://elnurbda.com/posts/49-pg-ctf-hutch/Proving Grounds Hutch write-up: from LDAP user discovery to abusing WebDAV uploads for ASPX RCE, and finally using LAPS to read back the local Administrator password.Thu, 22 Jan 2026 12:38:00 GMThttps://elnurbda.com/posts/48-pg-ctf-heist/https://elnurbda.com/posts/48-pg-ctf-heist/Proving Grounds Heist write-up: turn a URL feature into SSRF, capture an NTLMv2 hash with Responder, abuse a gMSA password reader and finish with SeRestorePrivilege.Thu, 22 Jan 2026 12:37:00 GMThttps://elnurbda.com/posts/47-pg-ctf-access/https://elnurbda.com/posts/47-pg-ctf-access/Proving Grounds CTF - Access. File upload vulnerability, Kerberoasting, and SeManageVolumePrivilege abuse.Thu, 22 Jan 2026 12:36:00 GMThttps://elnurbda.com/posts/46-k8s-nodeport-subdomain/https://elnurbda.com/posts/46-k8s-nodeport-subdomain/Expose Kubernetes NodePort services via subdomains using wildcard DNS and NGINX, without an Ingress controller.Thu, 08 Jan 2026 07:50:19 GMThttps://elnurbda.com/posts/45-presenterm/https://elnurbda.com/posts/45-presenterm/Why I like Presenterm for tech talks: write slides in Markdown, keep them in git, get code highlighting, diagrams and images, and present everything directly from the terminal.Tue, 02 Dec 2025 14:56:10 GMThttps://elnurbda.com/posts/44-gnu-ls/https://elnurbda.com/posts/44-gnu-ls/Master the Linux ls command with this complete guide covering basic to advanced options, hidden features, and modern alternatives to boost your terminal productivity.Sat, 09 Aug 2025 18:53:31 GMThttps://elnurbda.com/posts/33-pentest-tools-tldr/https://elnurbda.com/posts/33-pentest-tools-tldr/In this post, there will be a set of **TLDR**s (too long; didn't read) for categorized Penetration Testing tools.Thu, 22 May 2025 14:23:33 GMThttps://elnurbda.com/posts/42-it-planeta-task/https://elnurbda.com/posts/42-it-planeta-task/В этом отчете изложены все шаги по настройке Компонентов Обеспечения Информационной Безопасности. Это задание было одним из этапов сореванования по Кибербезопасности на платформе "IT PLANETA".Wed, 23 Apr 2025 14:27:26 GMThttps://elnurbda.com/posts/41-htb-ctf-administrator/https://elnurbda.com/posts/41-htb-ctf-administrator/Hack The Box Administrator: chain BloodHound-discovered ACL abuses (GenericAll → ForceChangePassword → GenericWrite) into DCSync, then crack the recovered Password Safe vault.Wed, 21 May 2025 10:46:41 GMThttps://elnurbda.com/posts/40-e2-micro-cloudflared/https://elnurbda.com/posts/40-e2-micro-cloudflared/Set up a free GCP e2-micro VM to host a self-hosted Gist with Opengist, secured via Cloudflare Tunnel — no cost, no open ports, fully controlled by you.Thu, 20 Feb 2025 06:13:16 GMThttps://elnurbda.com/posts/39-htb-ctf-escapetwo/https://elnurbda.com/posts/39-htb-ctf-escapetwo/Hack The Box EscapeTwo: MSSQL `xp_cmdshell` foothold, plaintext creds in config files, ESC4 certificate abuse, and a WriteOwner ACL chain to Domain Admin.Wed, 21 May 2025 10:46:41 GMThttps://elnurbda.com/posts/38-crto/https://elnurbda.com/posts/38-crto/Short review of the Certified Red Team Operator certification: course quality, lab environment, exam format and the AD/red teaming skills I realistically gained from it.Tue, 14 Jan 2025 10:08:34 GMThttps://elnurbda.com/posts/37-htb-ctf-cicada/https://elnurbda.com/posts/37-htb-ctf-cicada/Hack The Box CTF - Cicada. SMB shares, password spraying, RID brute-forcing, PrivEsc via Token Abuse Thu, 26 Dec 2024 13:14:35 GMThttps://elnurbda.com/posts/36-app-log-es/https://elnurbda.com/posts/36-app-log-es/How I wired a simple blog app’s logs into Elasticsearch: quick ELK + Nginx setup and a Winston + winston-elasticsearch logger inside a TypeScript ElysiaJS/Bun backend.Thu, 26 Dec 2024 06:05:05 GMThttps://elnurbda.com/posts/35-htb-ctf-chemistry/https://elnurbda.com/posts/35-htb-ctf-chemistry/Hack The Box CTF - Chemistry. Pymatgen CIF parser RCE, Credentials from SQLite database, Python aiohttp app vulnerable to path traversal (CVE-2024-23334).Wed, 21 May 2025 10:46:41 GMThttps://elnurbda.com/posts/32-icsd-mr-windoclin/https://elnurbda.com/posts/32-icsd-mr-windoclin/Mr. Windoclin — Challenge №12 from the ICSD 2024 'Who am I' CTF. Walkthrough of the Windows-themed challenge I authored, with the intended solution path.Tue, 24 Sep 2024 09:00:43 GMThttps://elnurbda.com/posts/31-ssh-cert-auth/https://elnurbda.com/posts/31-ssh-cert-auth/Minimal SSH certificate authentication lab: three Docker containers (CA, client, server) where we create a CA key, sign a user key and test SSH logins with certificates.Thu, 29 Aug 2024 10:22:28 GMThttps://elnurbda.com/posts/30-htb-ctf-monitorsthree/https://elnurbda.com/posts/30-htb-ctf-monitorsthree/Hack The Box MonitorsThree: error-based SQLi to admin, Cacti RCE for foothold, Duplicati auth bypass, and a Docker volume misconfiguration to escape to root.Tue, 27 Aug 2024 14:06:17 GMThttps://elnurbda.com/posts/27-htb-ctf-sea/https://elnurbda.com/posts/27-htb-ctf-sea/Hack The Box Sea write-up: use XSS to get RCE in WonderCMS, pivot into a user shell, then abuse a log-viewer LFI behind HTTP Basic auth to read /root/root.txt directly.Wed, 14 Aug 2024 10:39:05 GMThttps://elnurbda.com/posts/26-high-available-elk/https://elnurbda.com/posts/26-high-available-elk/Guest post by Telman: detailed walkthrough for building a highly available ELK stack on GCP with three Elasticsearch nodes, Logstash, Kibana and Filebeat sending logs.Sun, 11 Aug 2024 17:16:16 GMThttps://elnurbda.com/posts/25-ngrok-use-cases/https://elnurbda.com/posts/25-ngrok-use-cases/Ngrok examples I actually use: exposing local web servers, getting reverse shells, pivoting with chisel, bypassing restrictions and quickly sharing demos with others.Sun, 11 Aug 2024 16:00:57 GMThttps://elnurbda.com/posts/24-htb-ctf-resource/https://elnurbda.com/posts/24-htb-ctf-resource/Hack The Box Resource write-up: PHAR-based ZIP upload to get RCE, MySQL creds from the app, secrets in a HAR file, and SSH certificates to move from containers to the host.Sun, 11 Aug 2024 16:00:57 GMThttps://elnurbda.com/posts/29-htb-ctf-lantern/https://elnurbda.com/posts/29-htb-ctf-lantern/Hack The Box CTF - Lantern. SSRF, DLL Information Disclosure, File Upload Vulnerability, Execution of malicious DLL, PrivEsc with write process monitoring.Mon, 09 Sep 2024 20:54:01 GMThttps://elnurbda.com/posts/23-htb-ctf-editorial/https://elnurbda.com/posts/23-htb-ctf-editorial/Hack The Box Editorial write-up: turn the upload + URL feature into SSRF, grab internal API credentials, then abuse a Git history leak and a Python clone helper to get root.Mon, 05 Aug 2024 18:23:36 GMThttps://elnurbda.com/posts/22-htb-ctf-sauna/https://elnurbda.com/posts/22-htb-ctf-sauna/Hack The Box Sauna write-up: AS-REP roast fsmith, steal Autologon credentials for svc_loanmgr, then use DCSync and pass-the-hash to become Domain Admin.Sat, 03 Aug 2024 09:20:39 GMThttps://elnurbda.com/posts/21-htb-ctf-active/https://elnurbda.com/posts/21-htb-ctf-active/Hack The Box Active write-up: use a GPP password in Groups.xml to get SVC_TGS, Kerberoast Administrator’s SPN and then pass the ticket to log in as Domain Admin.Sat, 03 Aug 2024 09:20:38 GMThttps://elnurbda.com/posts/20-htb-ctf-forest/https://elnurbda.com/posts/20-htb-ctf-forest/Hack The Box Forest write-up: AS-REP roasting to get svc-alfresco, BloodHound to spot a DCSync path, and ACL abuse to dump Domain Admin credentials with secretsdump.Sat, 03 Aug 2024 09:20:37 GMThttps://elnurbda.com/posts/19-ecpptv3/https://elnurbda.com/posts/19-ecpptv3/Honest eCPPTv3 review: what the exam looks like, why I failed the first attempt, how I fixed my prep with AD labs, and whether I recommend spending money on it now.Fri, 02 Aug 2024 17:56:08 GMThttps://elnurbda.com/posts/17-htb-ctf-wifinetictwo/https://elnurbda.com/posts/17-htb-ctf-wifinetictwo/Hack The Box WifineticTwo write-up: exploit WPS with OneShot to get Wi‑Fi access, pivot into the OpenWrt router and use chisel + proxychains to reach the internal flag.Sun, 28 Jul 2024 09:29:30 GMThttps://elnurbda.com/posts/18-htb-ctf-permx/https://elnurbda.com/posts/18-htb-ctf-permx/Hack The Box PermX write-up: exploit Chamilo CVE-2023-4220, pivot with MySQL creds and password reuse, then abuse a symbolic-link based ACL helper for a clean root.Fri, 26 Jul 2024 18:35:02 GMThttps://elnurbda.com/posts/16-htb-ctf-boardlight/https://elnurbda.com/posts/16-htb-ctf-boardlight/Hack The Box CTF - BoardLight. Subdomain fuzzing, Exploiting Dolibarr 17.0.0, password reuse and suid privesc (CVE-2022-37706).Wed, 24 Jul 2024 11:30:44 GMThttps://elnurbda.com/posts/15-htb-ctf-greenhorn/https://elnurbda.com/posts/15-htb-ctf-greenhorn/Hack The Box GreenHorn write-up: from Gitea repo leaks and Pluck CMS RCE to deblurring a password in a PDF and reusing it to become root on the box.Wed, 24 Jul 2024 11:30:44 GMThttps://elnurbda.com/posts/14-htb-ctf-solarlab/https://elnurbda.com/posts/14-htb-ctf-solarlab/Hack The Box SolarLab write-up: abuse a ReportLab PDF generator for RCE, pivot into Openfire, recover the admin password and use it to finish with full domain compromise.Wed, 24 Jul 2024 11:30:44 GMThttps://elnurbda.com/posts/13-good-google-dorks/https://elnurbda.com/posts/13-good-google-dorks/A small set of Google dorks I actually reuse: for CTFs, tech events, startup slides, coupons and giveaways—mostly tuned for .az but easy to adapt to other countries.Tue, 16 Jul 2024 12:20:54 GMThttps://elnurbda.com/posts/12-named-pipe/https://elnurbda.com/posts/12-named-pipe/Short explanation of named pipes (FIFOs) on Linux and how they differ from regular pipes, plus a small netcat example that turns them into a simple bidirectional TCP proxy.Fri, 12 Jul 2024 12:20:54 GMThttps://elnurbda.com/posts/11-every-dev-aware/https://elnurbda.com/posts/11-every-dev-aware/Short list of free technologies and perks every developer or IT person should know: GitHub Student Pack, cloud credits, free domains and a few ways I actually used them.Tue, 18 Feb 2025 18:00:30 GMThttps://elnurbda.com/posts/10-thm-ctf-buffer-overflow/https://elnurbda.com/posts/10-thm-ctf-buffer-overflow/Write-ups for the TryHackMe rooms Brainpan 1 and Gatekeeper, focusing on classic Windows buffer overflows: offsets, bad chars, shellcode and finishing with SYSTEM access.Fri, 02 Jan 2026 18:20:03 GMThttps://elnurbda.com/posts/09-react-cheat-sheet/https://elnurbda.com/posts/09-react-cheat-sheet/React cheat sheet made from my notes: hooks, small snippets for data fetching, routing, Redux, Supabase and React Native so I can quickly recall patterns I use in projects.Mon, 01 Jul 2024 15:58:27 GMThttps://elnurbda.com/posts/08-ptarch/https://elnurbda.com/posts/08-ptarch/PTArch: my Arch-based pentesting environment. Starting from a plain VM, I add Budgie, terminal tweaks and a hand-picked toolset to get a lighter Kali-style lab.Fri, 02 Jan 2026 18:20:03 GMThttps://elnurbda.com/posts/07-pentester-notes/https://elnurbda.com/posts/07-pentester-notes/My penetration testing cheat sheet: commands and one-liners I actually use for recon, web, SMB/RDP, Linux and Windows privesc, brute forcing and shell stabilization.Fri, 02 Jan 2026 18:20:03 GMThttps://elnurbda.com/posts/06-htb-ctf-crafty/https://elnurbda.com/posts/06-htb-ctf-crafty/Hack The Box Crafty write-up: recon, identifying a Minecraft server, abusing Log4Shell for RCE, then reversing a plugin and using RunasCs to finish privesc on Windows.Fri, 02 Jan 2026 18:20:03 GMThttps://elnurbda.com/posts/05-linux-capabilities-privesc/https://elnurbda.com/posts/05-linux-capabilities-privesc/How Linux capabilities work in practice and how a misconfigured capability (CAP_SYS_ADMIN, CAP_DAC_READ_SEARCH, etc.) can lead to local privilege escalation, with hands-on examples.Fri, 02 Jan 2026 18:20:03 GMThttps://elnurbda.com/posts/04-thm-ctf-writeups/https://elnurbda.com/posts/04-thm-ctf-writeups/20 TryHackMe CTF write-ups based on my own notes, mostly medium to hard rooms, focused on practical enumeration, exploitation steps and privilege escalation ideas.Fri, 02 Jan 2026 18:20:03 GMThttps://elnurbda.com/posts/02-cinema-server/https://elnurbda.com/posts/02-cinema-server/Run your own Jellyfin cinema server: start it with Docker, mount your media, add nginx as a reverse proxy and stream movies from a simple self-hosted setup.Fri, 02 Jan 2026 18:20:03 GMThttps://elnurbda.com/posts/01-arch-linux-vm/https://elnurbda.com/posts/01-arch-linux-vm/Step-by-step guide to installing Arch Linux as a VMware virtual machine: simple UEFI setup, partitioning, base system, SSH access, user creation, and basic GUI.Fri, 02 Jan 2026 18:20:03 GMThttps://elnurbda.com/posts/03-windows-on-docker/https://elnurbda.com/posts/03-windows-on-docker/Alternative way to run Windows on Linux: use Docker with a Windows image, web UI and RDP support instead of heavy VMs, and get a smoother desktop experience.Fri, 02 Jan 2026 18:20:03 GMT