Guilherme Alves

Windows PG box. Remote Mouse 3.008 on port 1978 runs commands unauthenticated, FileZilla's recentservers.xml leaks divine's password, and its GUI gives SYSTEM.

CVE-2023-32315 creates an Openfire admin, a malicious plugin gives a shell, and the SMTP password stored in openfire.script turns out to be root's password.

Windows Proving Grounds box. A cookie based rate limit bypass (CVE-2018-11678) brute forces Monstra CMS, then XAMPP CVE-2020-11107 escalates to Administrator.

Windows box running BarracudaDrive. WebDAV leaks the app database, a password reminder reset hijacks an account, and a writable folder swaps bd.exe for SYSTEM.

Laravel 8.4.0 with debug mode on falls to CVE-2021-3129, a writable artisan script hijacks a cron job as skunk, and sudo composer runs a script as root.

Windows AD box. info:info opens the domain, SYSVOL leaks Start123!, MSSQL impersonation gives hrapp-service, and Server Operators dumps the SAM.

Linux Proving Grounds box. htmLawed 1.2.5 CVE-2022-35914 gives a shell as www-data, and a root-run cleanup.sh owned by www-data escalates to root.

Windows box. index.php includes whatever the page parameter names, so a remote PHP shell runs as rupert, and a writable Backup folder swaps TFTP.EXE for admin.

Windows AD Proving Grounds box. A password spray finds andrea.hayes, kerberoast and GenericAll reach WinRM, and a silver ticket plus GodPotato gives SYSTEM.

Hard Windows AD box. Anonymous FTP leaks the user list, Summer2024! sprays into Emma.Bell, and a Kerberos only web app exposes a file download LFI.

Linux target. A fresh WordPress install points at an attacker database, a vulnerable plugin uploads a shell, and the disk group reads root's hash from shadow.

Windows target. A guest SMB share leaks WordPress passwords, the 404 theme template becomes a web shell, and AlwaysInstallElevated hands over SYSTEM.

FuguHub 8.1 still has its admin account unclaimed, so registering it and running the CVE-2023-24078 exploit uploads a Lua .lsp shell that runs as root.

Windows box. Names off the team page brute force IMAP, a LibreOffice macro mailed to mailadmin lands a shell, and swapping VeyonService gives SYSTEM.

Windows AD Proving Grounds box. A .htaccess trick uploads a PHP shell, kerberoast cracks svc_mssql, and SeManageVolume plus WerTrigger gives SYSTEM.

Windows box. An open Squid proxy reaches an internal WampServer, phpMyAdmin writes a webshell with INTO OUTFILE, and GodPotato turns that into SYSTEM.

Windows Proving Grounds box. Argus Surveillance DVR directory traversal reads viewer's SSH key, and its weak password encryption gives Administrator.

Windows 7 target running HP Power Manager 4.2. The admin/admin default login confirms the version, and a formExportDataLogs overflow returns a SYSTEM shell.

Windows Proving Grounds box. A passwordless H2 1.4.199 console runs JNI code execution for a shell as tony, and SeImpersonate with GodPotato gives SYSTEM.

Windows AD target. A null session reads a password out of a user description, a shared NTDS.dit dumps every hash, and RBCD impersonates Administrator.

Windows Server 2008 SP1 target with nothing usable exposed but SMB. AutoBlue's MS17-010 EternalBlue exploit with the x86 shellcode returns a SYSTEM shell.

Windows PG box. Anonymous LDAP leaks a password in a user description, WebDAV takes an aspx webshell, and the same account reads the LAPS admin password.

Easy Linux box. admin:admin opens Apache ActiveMQ 5.15.15, CVE-2023-46604 in OpenWire returns a shell, and sudo nginx writes root's authorized_keys.

Windows target. Anonymous FTP names admin, hydra guesses its password, the .htpasswd hash cracks to offsec, and JuicyPotato turns a PHP webshell into SYSTEM.

Linux target. An unauthenticated YAML write in Grav CMS 1.10.7 gives a shell as www-data, and the intended root is a SUID php binary straight out of GTFOBins.

Linux Proving Grounds box. A salt-api 3000 on port 8000 is vulnerable to CVE-2020-11651, letting an attacker write root's authorized_keys for an SSH login.

Linux target. Subrion CMS 4.2.1 falls to admin:admin and an arbitrary file upload, then a root cron running exiftool 11.88 executes a malicious DjVu image.

A SQL injection bypasses the login form, the dashboard behind it hands over base64 passwords for Cockpit on port 9090, and a sudo tar wildcard gives root.

Linux target. A Cassandra Web file read exploit exposes the FreeSWITCH event socket password for a shell, and cassie's id_rsa logs straight in as root.

Medium Linux box. An analysis log leaks an internal Gitea vhost, a malicious browser extension fires bash arithmetic injection, and a poisoned .pyc gives root.

Linux Proving Grounds box. Exhibitor for ZooKeeper runs commands through its java.env field for a shell as charles, and sudo gcore dumps root's password.

Linux Proving Grounds box. A mass assignment confirms the account, an LFI file manager writes remi's authorized_keys, and a root SSH alias gives root.

Medium Windows box. CSRF and blind XSS in a note-sharing app steal admin credentials, SMB write plants an ASPX webshell, and WSL history leaks the admin.

Easy Linux box. Jinja2 SSTI on a virtual host gives RCE, audit logs leak credentials for a user in adm, and SplunkWhisperer2 escalates to root.

Medium Linux box. A leaked SuperSecureServer.py runs the request path through exec(), a known plaintext attack recovers robert's key, and sudo gives root.

Medium Linux box. A jackson-databind validator falls to CVE-2019-12384 via an H2 RUNSCRIPT, and a root systemd timer runs a writable backup script.

Easy Linux box. FTP and robots.txt leak backup archives with credentials, Adminer CVE-2021-43008 reads files, and a SETENV sudo rule hijacks PYTHONPATH.

Medium Windows AD box. LDAP null-bind finds a VNC password, a .NET assembly gives up an AES key, and a deleted account in the AD Recycle Bin grants admin.

Medium Linux box. NoSQL injection against a MongoDB login form extracts credentials character by character, and GTFOBins jjs escalates the pivot to root.

Medium Linux box. SQL injection bypasses the login, a magic-bytes polyglot beats upload validation for RCE, and PATH hijacking on a SUID binary gives root.

Easy Linux box. A .php.gif double extension upload gives apache, a filename command injection in guly's cron lands user, and sudo ifup sources a root shell.

Medium Windows AD box. LDAP null-bind and a username-as-password spray get SMB access, and an Azure AD Connect config leaks the domain admin password.

Medium Windows AD box. A null session reads marko's description for a default password, melanie sprays into WinRM, and DNSAdmins loads a DLL as SYSTEM.

Easy Linux box. A NoSQL injection dumps the admin hashes, a private Mattermost channel leaks jaeger's SSH password, and the docker group turns deploy into root.

Medium Windows box. An open Jenkins script console on port 50000 gives a shell as kohsuke, and SeImpersonatePrivilege with JuicyPotato yields SYSTEM.

Medium Windows box. Drupal 7.54 on IIS gives RCE through its Services module, and an unpatched Server 2008 falls to the MS15-051 local exploit for SYSTEM.

Easy Linux box. The XSLT parser is left unhardened, so a stylesheet writes a Python file into a cron directory, and sudo needrestart hands over root.

Easy Linux box. CVE-2025-31161 bypasses CrushFTP auth, a mounted webroot takes a PHP shell, and CVE-2025-32433 in Erlang SSH sets the SUID bit on /bin/bash.

Easy Windows box. A public NFS share holds Umbraco.sdf, whose SHA1 admin hash cracks to baconandcheese, and the authenticated Umbraco RCE leads to SYSTEM.

Easy Linux box. An unauthenticated Redis 4.0.9 writes an SSH key, a cracked id_rsa.bak backup gives Matt, and Webmin 1.910 RCE runs as root.

Easy Linux box. CVE-2019-17240 defeats Bludit's login rate limit, an image upload flaw gives a shell, and sudo -u#-1 turns a !root rule into a root shell.

Easy Linux box. A leftover smevk.php webshell with default creds gives webadmin, luvit sudo runs a Lua shell as sysadmin, and a writable MOTD script gives root.

Easy Linux box. CVE-2019-16278 in nostromo 1.9.6 gives RCE, a public_www backup leaks david's SSH key, and sudo journalctl escapes to root via its pager.

Easy Windows box. Gym Management 1.0 gives unauthenticated RCE as shaun, and a CloudMe 1.11.2 buffer overflow reached over chisel gives administrator.

Easy Windows box. SQL injection on the admin login yields a shell in a boot2docker container, and the default docker:tcuser SSH login reaches the host C drive.

Medium Linux box. An exposed .git leaks a PDO backtick SQL injection, an admin bid rule runs PHP for a shell, and a YAML sandbox rewrite SUIDs bash.

Medium Linux box. A JSON body of password true bypasses the API login, bkcrack breaks a ZipCrypto archive for an SSH key, and the source leaks root's password.

Easy Windows box. IIS shortname enumeration finds transfer.aspx, a web.config upload runs a PowerShell reverse shell, and MS16-075 Juicy Potato gives SYSTEM.

Easy Windows box. sqlmap on the admin login form yields OS command execution as phoebe, creds sit in conn.php, and AlwaysInstallElevated gives SYSTEM.

Easy Linux box. A git commit leaks dev01 credentials, encoded path traversal reaches the Werkzeug PIN, and a root git-sync job runs a rogue pre-commit hook.

Easy Linux box. CVE-2022-0739 in BookingPress dumps WordPress hashes, an XXE in WordPress 5.6.2 reads wp-config.php, and a cracked passpie key gives root.

Hard Linux box. A default password opens the student portal, an IDOR leaks Gitea creds, a PhpSpreadsheet XSS steals a lecturer session, and sudo gives root.

Easy Linux box. A NoSQL $ne login bypass opens the admin panel, XXE in the XML upload leaks server.js, and unserialize on the auth cookie gives a shell.

Easy Linux box. A Mattermost internal channel leaks SSH credentials, and hashcat rules turn the mattermost root hash into the system root password.

Easy Linux box. An LFI in news.php reads tomcat-users.xml, a WAR deploy gives a shell, a cracked zip password reuses as ash, and the lxd group mounts the host.

Medium Linux box. CuteNews leaks its user hashes and takes a PHP avatar webshell, a shared SSH key reaches nadav, and USBCreator overwrites /etc/sudoers.

Hard Linux box. WebDB guesses the PureFTPd database password, editing the FTP user row plants an SSH key for tyrell, and etcd vhost injection returns root.

Hard Windows AD box. A cracked KeePassXC database yields MSSQL credentials, then a constrained delegation chain and SeEnableDelegationPrivilege reach DCSync.

Medium Windows AD box. NFS exposes files that lead to a sprayed foothold, then PetitPotam coerces the DC and ADCS ESC8 issues a certificate good for DCSync.

Hard Windows AD box from VulnLab. A WIM image exposes SAM hashes, ADCS ESC1 abuses certificates, and RemotePotato0 relays Net-NTLMv2 to take the domain.

Easy Linux box. A hidden role parameter in a Laravel signup grants admin, CVE-2018-15133 deserialization gives a shell, and sudo Composer escalates to root.

Easy Linux box. Magento 1.9.0.0 falls to the Shoplift SQL injection for an admin account, an authenticated RCE gives www-data, and sudo vi gives root.

Easy Windows AD box. A corrupted xlsx on an SMB share leaks passwords, sa on MSSQL gives a shell, and an ESC4 template hijack mints the Administrator.

Easy Windows AD box. A guest share leaks UserInfo.exe and its LDAP password, the support account's info field holds another, and GenericAll enables DCSync.

Easy Linux box. An unauthenticated Kubelet API lets kubeletctl exec into the nginx pod, whose service account token then creates a pod mounting the host disk.

Easy Linux box. A secret.txt password logs into Joomla for RCE, a nested password_backup unpacks to floris' SSH creds, and a root curl config reads files.

Easy Linux box. SQL injection dumps the admin hash, Jinja2 SSTI on a hidden vhost gives root in a container, and a mounted home directory SUIDs bash.

Easy Linux box. Stored XSS in the markdown viewer makes the admin read messages.php, path traversal leaks .htpasswd, and a writable config.php gives root.

Medium Linux box. An Express app deserializes a base64 profile cookie with node-serialize, and a root cron running a writable script.py SUIDs bash.

Easy Linux box. The store subdomain reflects email into a Nunjucks template, SSTI returns a shell as david, and a perl capability gets past AppArmor.

Easy Android box. CVE-2019-6447 in ES File Explorer reads creds.jpg off the device, SSH gets in as kristi, and forwarded ADB on 5555 gives root.

Easy pfSense box. Gobuster finds system-users.txt naming rohit, the company default password logs in, and a graph injection exploit lands a root shell.

Easy Linux box. A DNS zone transfer confirms bank.htb, a 302 that still returns support.php leads to a .htb file upload, and a setuid binary gives root.

Medium Windows AD box. Anonymous FTP leaks a service account, AS-REP roasting cracks it, a Zip Slip DLL hijack lands a shell, and KrbRelayUp gives SYSTEM.

Easy Windows box. ColdFusion 8 on port 8500 leaks files and an FCKeditor upload lands a shell as tolis, then unpatched Server 2008 falls to MS10-092.

Easy Linux box. A Raspberry Pi running Pi-hole keeps the default pi and raspberry login, sudo is unrestricted, and root.txt comes back out of /dev/sdb.

Easy Linux box. Credentials sit in a JavaScript file, the filetype parameter of the printer endpoint injects commands, and a sudo script with SETENV gives root.

Easy Linux box. NFS exports with no squashing let a matching local UID drop a webshell, and ross's .Xauthority screenshots an unlocked KeePassXC vault.

Medium Windows AD box. A writable SMB share and Responder capture julia.wong's hash, Kerberoasting gives svc_mssql, and a silver ticket leads to Administrator.

Easy Linux box. An OpenWrt backup on anonymous FTP leaks a WPA key reused for SSH, and a WPS pixie dust attack with Reaver recovers the root password.

Easy Windows AD box. The printer panel binds to any LDAP server, so Responder catches svc-printer in cleartext, and Server Operators turns that into SYSTEM.

Easy Linux box. SNMP leaks the JetDirect telnet password as hex, its exec command returns a shell as lp, and CVE-2012-5519 in CUPS reads any file as root.

Easy Linux box. Request Tracker keeps its default root login, a user comment leaks an SSH password, and CVE-2023-32784 pulls a KeePass key out of a crash dump.

Medium Windows AD box. intern:intern opens Lansweeper, an SSH honeypot harvests a scanning credential, and GenericAll plus LansweeperDecrypt reach SYSTEM.

Easy Linux box. SNMP leaks daniel's SSH password, an unauthenticated Pandora FMS SQLi gives matt, and a relative-path tar in a SUID binary gives root.

Easy Linux box. Default Tiny File Manager creds upload a PHP shell, blind SQL injection over websockets dumps player's password, and doas dstat gives root.

Easy Linux box. HelpDeskZ stores a PHP shell even while rejecting it, its config leaks the MySQL root password, and CVE-2017-16995 gives root.

Medium Linux box. An exposed .git leaks a Special-Dev header, a zipped PHP shell renamed .txt runs through phar://, and sudo easy_install gives root.

Medium Windows AD box. An SMB email leaks the onboarding password, a VeraCrypt backup gives up svc_sspr, and RBCD on an SPN-less user reaches Administrator.

Medium Windows AD box. MSSQL leaks NTLMv2 through xp_dirtree, SQL Server logs hold plaintext credentials, and ADCS ESC1 impersonates the domain admin.

Easy Windows box. Phishing with a malicious LibreOffice macro lands a foothold, an IIS web shell gives RCE, and token impersonation escalates to SYSTEM.

Medium Windows AD box. Guest SMB leaks reset accounts, kpasswd claims one, GenericAll on ADMSVC reads a GMSA hash, and an ESC4 template hijack gives DA.

SYSVOL leaks a credential, GenericWrite enables a targeted Kerberoast, and SeEnableDelegationPrivilege stages a PrinterBug coercion that ends in DCSync.

Guest SMB and a username-as-password spray get credentials, a writable SYSVOL logon script gives a shell, and WriteOwner over gpoadm ends in pyGpoAbuse.

Easy Linux box. Grafana path traversal (CVE-2021-43798) reads the SQLite database, bcrypt hashes fall to Hashcat, and a privileged Docker container escapes.

A password reset endpoint returns the new password, LFI plus log poisoning gives a shell, and rsh trust files lead to sadm and a GTFOBins nano escape.

An MS Access database cracked with office2john leaks LDAP credentials, Timeroasting cracks computer accounts, and Perfusion roots a Server 2008 host.

Java RMI on 2222 dumps Tomcat credentials for RCE, a backup directory leaks SSH keys and a TOTP secret, and a sudo adduser rule creates a user named admin.

Easy Linux box. LimeSurvey exploitation via a malicious plugin upload gives RCE, and a shared mount point is used to escape the container onto the host.

An is-it-down app passes URLs to curl unsanitized, giving file:// reads and argument injection, then a brute-forced pswm vault and the sudo group give root.

LDAP leaks a password in a description field, a spray finds an account forced to change it, and SeBackupPrivilege dumps NTDS.dit for the Administrator hash.

Only RDP is exposed. Disabling NLA reveals kiosk credentials, cmd.exe renamed to msedge bypasses UAC, and a Remote Desktop Plus profile decrypts to admin.

A Gitea API key in git history opens a private repo with CI/CD, a webshell push lands a foothold, and PDF24 MSI repair with an oplock gives SYSTEM.

Easy Windows AD box. A bogus username gets guest access, the Trainees share leaks trainee:trainee, and a pre2k computer account turns ESC1 into domain admin.

Medium Windows AD box. A cracked Excel file leaks passwords, targeted Kerberoasting lands WinRM, and a restored tombstone plus DPAPI leads to ntds.dit.

Medium Windows AD box. AS-REP roasting cracks svc_backup, Kerberoasting gives svc_web, an ACL chain reaches rachel.ops, and a keytab leaks the admin hash.

Medium Windows AD box, Kerberos only. A password reset hint gives ksimpson, kerberoasting yields sqlsvc, and a silver ticket opens MSSQL as Administrator.

Insane Windows AD box. SMB RID-bruting leads to AS-REP roasting and Kerberoasting, then shadow credentials, a RemotePotato relay and RBCD take the domain.

An honest review of TryHackMe's PT1 entry-level pentest certification: web exploitation, network pentesting, AD attacks, and how it reads as OSCP prep.

Hard Windows AD box. Timeroasting cracks a machine account, pulling IT out of Protected Objects frees Kerberos, and a 7-Zip COM hijack ends in RBCD.

Windows AD room. Staff names become usernames, j.rock turns out to be AS-REP roastable, and a binPath rewrite on the cfn-hup service returns SYSTEM.

Windows AD room. Guest SMB and LDAP description fields leak CHANGEME2023!, and an ESC1 template lets certipy mint a certificate for the Administrator.

Hard Windows AD box. Crackable PFX files on an NFS export give d.baker, ForceChangePassword and ADCS ESC9 chain to h.brown across the domain.

Easy Linux box. CVE-2024-9264 in Grafana gives a container shell, env vars leak enzo's SSH password, and a root cron manager on port 8000 runs a reverse shell.

Hard Windows AD box. CVE-2024-36991 leaks splunk.secret, a gMSA and shadow credentials chain reaches edward.martin, and a Splunk app payload lands SYSTEM.

Easy Windows AD box. CVE-2025-24071 in a writable share captures p.agila's Net-NTLMv2 hash, and GenericWrite plus ADCS ESC16 yields the Administrator hash.

Hard Windows AD box. An LFI triggers SMB hash capture via LLMNR poisoning, then unconstrained delegation and PrinterBug steal the DC's TGT for DCSync.

Medium Windows AD box. BloodHound finds GenericAll over a group, self-addition opens a KeePass database in SMB, and DPAPI secrets recover admin credentials.

Hard Windows AD box. An SMTP service accepts weaponized RTF attachments for initial access, then BloodHound maps misconfigured ACLs through to Domain Admin.

Insane Windows AD box. OWA credential spraying opens a mailbox, a LibreOffice macro captures Net-NTLMv2, and Wamp misconfigs lead to domain compromise.

Hard Windows AD box. Orchard CMS credentials come out of a MSSQL database found by connection string discovery, then MS14-068 forges a PAC to Domain Admin.

Insane Windows AD box. LLMNR poisoning steals NTLM hashes, ADCS issues a cert for PSRemoting, Kerberoasting cracks a service account, DCSync ends it.

Medium Linux box. Enumeration notes: nginx on 443 with a craft.htb certificate, a Go SSH service on port 6022, and vhost fuzzing that turns up api and vault.

Easy Windows box. A guest readable Backups share holds a VHD, secretsdump pulls bureaulampje from its hives, and mRemoteNG gives up the Administrator.

Hard Windows AD box. A pre-Windows 2000 computer account yields a gMSA password, an AS-REP roast cracks svc_sql, and DPAPI plus RBCD reach Domain Admin.

Medium Linux box. An LFI in the Rails API leaks a SQLite database, ralph's hash cracks, LimeSurvey 6.6.4 gives RCE, and a local Consul API hands over root.

Easy Linux box. An exposed .git directory leaks the Backdrop CMS database password, an authenticated 1.27.1 RCE gives a shell, and sudo bee eval grants root.

Easy Windows AD box. Names on /about.html build a username list, AS-REP roasting cracks fsmith, and winpeas finds autologon credentials for svc_loanmanager.

Easy Windows box. A guest login on the support portal leaks a Cisco IOS config, hashcat and type 7 decoding give Chase, and a Firefox dump gives admin.

Hard Windows AD box. SMB guest access lists the domain, an offline Kerberos crack gives support, an ACL resets audit2020, and an LSASS dump yields svc_backup.

Medium Linux box. Go template injection on the reset form leaks creds and runs commands, an S3 webshell gives www-data, and an nginx backdoor runs as root.

Easy Linux box. An exposed .git dump leaks the Ghost admin password, CVE-2023-40028 reads bob's SMTP creds, and a symlink sudo script leaks root's key.

Medium Windows AD box. GenericAll lets olivia reset michael, benjamin pulls a Password Safe vault off FTP, and a kerberoast on ethan ends in DCSync.

Easy Linux box. SQLPad CVE-2022-0944 template injection gives a container root shell, /etc/shadow hashes crack to michael, and Froxlor PHP-FPM runs as root.

Easy Linux box. A public Gitea repo leaks the Pluck CMS password hash, CVE-2023-50564 gives RCE, and Depix recovers the root password from a pixelated PDF.

Easy Linux box. A crafted CIF file fires CVE-2024-23346 in pymatgen, cracked MD5 hashes hand over rosa, and CVE-2024-23334 in aiohttp reads root's SSH key.

Easy Windows AD box. An SMB share leaks the new hire default password, a user description hides another, and Backup Operators dumps SAM for the admin hash.

Hard Windows box. An IDOR in the QR login takes over admin, the SQL terminal runs xp_cmdshell as sa, and a setup INI leaks a password reused elsewhere.

Medium Windows box. An anonymous SMB share leaks a credentials spreadsheet, a password spray opens ReportHub, and ReportLab CVE-2023-33733 gives RCE.

Medium Linux box. CVE-2023-42793 on a hidden TeamCity vhost gives RCE, its backup leaks an SSH key and a bcrypt hash, and Portainer mounts the host disk.

Medium Windows AD box. An XMPP user search lists the domain, AS-REP roasting cracks jmontgomery, a chat room leaks svc_openfire, and CVE-2023-32315 is SYSTEM.

Easy Linux box. Blind SQLi in the reset form dumps admin_users, laravel-admin takes a php upload, and a 7za wildcard reads root's SSH private key.

Medium Windows box. A .phar upload lands in a Linux VM, CVE-2023-2640 gives root and drwilliams, and a GhostScript .eps mailed to drbrown ends as SYSTEM.

Medium Linux box. Blind XSS steals the admin session cookie, a Jinja2 SSTI in the QR generator gives a shell, and sudo qpdf reads any file as root.

Medium Linux box. Default creds and OpenPLC CVE-2021-31630 give RCE, then a WPS pixie dust attack joins plcrouter and SSHes to the gateway as root.

Hard Linux box. A WordPress plugin LFI leaks wp-config, Cacti 1.2.12 gives a shell, and an internal Apache OFBiz on 8443 gives root inside a container.

Easy Linux box. Blind XSS in the support form steals the admin cookie, the dashboard date field injects commands, and sudo syscheck runs a planted initdb.sh.

Hard Linux box. Blind XSS steals the admin chatbot history, a simple-git RCE gives a shell, and LibreOffice UNO over sudo sets the SUID bit on bash.

Insane Linux box. A %0a bypass and MinIO CVE-2023-28432 leak admin keys, a Vault OTP logs in as askyy, and a vault-unseal race condition gives root.

Hard Linux box. Default admin:admin on a Docker registry leaks an SSH key, a cracked Bolt CMS hash gives a web shell, and sudo restic exposes root's key.

Medium Linux box. SQL injection in room.php gives an os-shell as www-data, a sudo Python script runs commands as pepper, and SUID systemctl gives root.

CVE-2021-44228 end to end: a dockerised vulnerable Java web app, a fake LDAP server, and a JNDI lookup string that returns a reverse shell on Java 8u20.

Medium Linux box. Anonymous FTP holds an encrypted file that cracks to the Drupal admin password, the PHP filter module runs code, and H2 Console gives root.

Medium Linux box. SQL injection bypasses the torrent host login, a PHP shell uploaded as a torrent screenshot gives a foothold, and Dirty COW gives root.

Medium Linux box. Default root:root on James 2.3.2 resets mailbox passwords, an email leaks mindy's SSH login, and a world-writable /opt/tmp.py runs as root.

Medium FreeBSD box. An LFI in browse.php exposes pwdbackup.txt, whose repeatedly base64 encoded password logs in as charix, and a stored VNC password is root.

Easy Windows box. HttpFileServer 2.3 on port 80 falls to CVE-2014-6287 for a shell as kostas, and MS16-032 escalates that session to SYSTEM.

Hard Linux box. SQLi dumps the users table, a PHP type juggling collision logs in as admin, a truncated filename uploads a shell, and disk group reads root.

Easy Linux box. A Minecraft plugin jar under /plugins hardcodes the MySQL root password, notch reuses it over SSH, and unrestricted sudo gives root.

Easy Windows box. Anonymous FTP serves the whole C drive, a PRTG configuration backup leaks the admin password, and a PRTG 18.1.37 RCE creates a local admin.

TryHackMe side quest on a PCAP. Crack the WPA handshake with aircrack-ng, decrypt the traffic, find mimikatz over WinRM, and replay RDP with pyrdp.

JexBoss tests and exploits JBoss and Java deserialization flaws. Install it, scan a network, and get a reverse shell through jmx-console, Invoker or Struts2.

Medium Linux box. exposed.php passes user input into curl, which uploads a PHP shell to /uploads for www-data, and SUID screen 4.5.0 (CVE-2017-5618) gives root.

Hard Linux box. An open SMB share leaks a mail backup, a gopher SSRF sends a phishing mail carrying a macro ODT, and a setuid notes binary hijacks tar.

Hard Linux box. An LFI leaks the BIND TSIG key, nsupdate hijacks the Mattermost reset mail, and sudo git apply writes sbrown's authorized_keys.

Medium Linux box. A DNS zone transfer finds admin.cronos.htb, SQLi bypasses the login, a ping panel injects commands, and a root cron runs Laravel artisan.

Hard Linux box. TFTP hands over the squid config and password file, a Werkzeug console behind the proxy gives a UDP shell, and a tar wildcard cron gives root.

Medium Linux box. An NFS backup leaks the source, a role parameter trick grants admin, a PHP nickname export gives RCE, and PERL5OPT through sudo gives root.

Medium Windows AD box. An open SMB share hides an Ansible vault holding PWM's LDAP creds, and a CorpVPN certificate request becomes the Administrator.

Easy Solaris box. The finger service enumerates sammy and sunny, an SSH brute force cracks sunny, a shadow backup gives sammy, and sudo wget gives root.

Easy Linux box. A NoSQL injection bypasses the dev.stocker.htb login, HTML to PDF rendering reads local files, and a sudo node wildcard gives root.

MQTT room. An open Mosquitto 2.0.14 broker publishes every topic, and a base64 config message reveals the hidden topic pair that runs system commands.

Easy Linux box. The bug report form posts base64 encoded XML, so XXE reads db.php, and that database password is reused for the development user over SSH.

Easy Linux box. A gRPC service on 50051 hands sqlmap a SQLite injection, the sau password opens SSH, and pyLoad on 8000 runs an unauthenticated RCE as root.

SQLi in the it-next cart dumps the WordPress users, a 404.php shell lands www-data, memcached leaks Orka's password, and a sudo script gives root.

A PHP hash_hmac type juggling bypass and an X-Forwarded-For check get you a shell, then a PATH hijack in a setuid wrapper rewrites /etc/shadow for root.

TryHackMe Linux box. A passwordless MySQL admin reconfigures OpenEMR 5.0.1.3 for authenticated RCE, then an rsync wildcard cron and perl cap_fowner give root.

Linux room. GitTools dumps an exposed .git for an API key, sqlmap turns documentid into an OS shell, and pivoting reaches a vsftpd 2.3.4 backdoor and BGP.

Linux room. An LFI in post.php leaks FTP credentials, an uploaded PHP shell starts a chain through toby, mat and will, and an adm backup holds root's key.

Easy Linux box. Apache OFBiz 18.12 falls to CVE-2023-51467 for a shell, and the Derby database's admin hash cracks against a rebuilt OFBiz routine.

Medium Linux box. Command injection in the contact form gives a shell, Cypher injection against neo4j leaks john's hash, and sudo pip3 download runs as root.

Short lab note. An SSH port forward reaches ZoneMinder, the snapshots Metasploit module returns a shell, and sudo zmupdate.pl runs a script as root.

Easy Linux box. A vm2 sandbox escape in the Codify editor gives a shell as svc, a cracked hash from tickets.db gives joshua, and a wildcard compare gives root.

Medium Linux box. Jinja2 SSTI in the PGP signature form gives a shell, httpie session files leak silentobserver, and a SUID firejail binary gives root.

Easy Windows AD box. A RID brute finds operator using its own name as a password, MSSQL xp_dirtree leaks a web backup, and ESC7 mints the Administrator.

Windows target on the lab range with only SMB and RPC exposed. An nmap vuln scan flags MS17-010, and the Metasploit eternalblue module returns a SYSTEM shell.

Easy Linux box. A Spring Boot actuator leaks a session cookie, the scanner injects commands, a decompiled jar gives postgres, and sudo ssh gives root.

Every flag in the mansion, from the dining room emblem to the four encoded crests that hide the FTP login, then umbrella_guest over SSH and root as weasker.

Hard room. A cracked backup.zip leaks the WordPress password, a vulnerable plugin gives a shell inside Docker, and a tar wildcard over FTP escapes to the host.

Reference notes for mimikatz: the sekurlsa, kerberos, crypto, vault and lsadump command groups, plus how to build the solution from source in Visual Studio.

Windows AD room. A password reset answer is guessable from an image filename, a Spark chat XSS leaks an NTLM hash, and a cron script runs Invoke-Expression.

Red team lab. An LFI on dev.holo.live leaks creds, RCE lands in a container, a MySQL OUTFILE webshell breaks out, and SUID docker gives root.