Passge — CuteNews RCE to Root via USBCreator DBus
Passage is a medium difficulty Linux machine that hosts a CuteNews web application.
RhHmz4
Blurry — DevOps & ML Attack Chain on Linux
Blurry is a medium-difficulty Linux machine that features DevOps-related vectors surrounding machine learning.
BoardLight — Exploiting Dolibarr via CVE-2023-30253
BoardLight is an easy difficulty Linux machine that features a `Dolibarr` instance vulnerable to CVE-2023-30253.
Busqueda — Python Module Command Injection to Root
Busqueda is an Easy Difficulty Linux machine that involves exploiting a command injection vulnerability present in a `Python` module.
Cascade — LDAP Anonymous Bind to Active Directory Takeover
Cascade is a medium difficulty Windows machine configured as a Domain Controller where LDAP anonymous binds are enabled.
Crafty — Hacking a Minecraft Server to Compromise Windows
Crafty is an easy-difficulty Windows machine featuring the exploitation of a `Minecraft` server.
Blackfield — AD Misconfigurations & OSAD Escalation
Backfield is a hard difficulty Windows machine featuring Windows and Active Directory misconfigurations.
Sauna — Windows AD Enumeration & Privilege Paths
Sauna is an easy difficulty Windows machine that features Active Directory enumeration and exploitation.
Active — Common AD Techniques for Privilege Escalation
Active is an easy to medium difficulty machine, which features two very prevalent techniques to gain privileges within an Active Directory environment.
PhotoBomb — Plaintext Credentials & Blind Command Injection
Photobomb is an easy Linux machine where plaintext credentials are used to access an internal web application with a `Download` functionality that is vulnerable to a blind command injection.