Living Off the Vault: From ‘I’m Staff’ to Breaking Custom Cryptography

metesec@outlook.com (Mete Demirci) — Thu, 27 Aug 2026 00:01:00 +0200

It started with a chatbot. It ended with an enterprise password vault decrypted without its master password. Everything in between involved an FTP jail escape, an Electron AppImage, a native Node.js add-on and a custom cipher that collapsed under its own mathematics.

I recently worked through OffSec’s Living Off the Vault challenge, and it had one of the strangest technical progressions I have seen in a lab so far.

The first page looked like a normal support portal. A few stages later, I was analyzing an affine substitution box and using the application’s own native encryption primitive against it.

Following the Evidence Through OffSec's Dune Phantom

metesec@outlook.com (Mete Demirci) — Wed, 26 Aug 2026 22:00:00 +0200

Four investigations. Four completely different environments. One lesson that kept returning: follow the evidence, not the loudest alert.

Over the last few weeks, I worked through OffSec’s Dune Phantom challenge series.

I considered writing four separate walkthroughs. Instead, I wanted to capture the investigation as a single story—because what made the series memorable was not any individual answer. It was how radically the environment changed from one week to the next while the investigative method stayed the same.

Reverse Engineering on MeteSec

Living Off the Vault: From ‘I’m Staff’ to Breaking Custom Cryptography

Following the Evidence Through OffSec's Dune Phantom