Build is a medium Linux machine built around a DevOps pipeline. An anonymous rsync share leaks a full Jenkins backup that contains both an encrypted job password and the very key files needed to decrypt it offline — recovering the password Git1234!. Those credentials log into Gitea as buildadm, and that repository has a webhook wired to an internal Jenkins server, so committing a malicious Jenkinsfile triggers the pipeline and runs a reverse shell as root inside the Jenkins container, yielding the user flag. This post covers recon through user.txt.

A Starting Point box where the web server's document root is an S3 bucket with no authentication — listing the bucket reveals the webroot, and an unauthenticated PUT drops a PHP webshell for immediate RCE.

Bruno is a medium Windows domain controller. Anonymous FTP exposes a custom .NET scanning service and the name of a service account, svc_scan, whose Kerberos pre-authentication is disabled — its AS-REP hash cracks to a weak password. That account can write to a share the scanner watches, so a zip-slip archive plants a malicious DLL into the app directory and a DLL search-order hijack runs code as svc_scan, landing the user flag. This post covers recon through user.txt.

Cerberus chains an unauthenticated Icinga Web 2 file disclosure into authenticated RCE inside a Linux container, escalates to container root through a SUID firejail race, cracks an SSSD-cached domain password to pivot over WinRM, and finishes with a ManageEngine ADSelfService Plus SAML signature-bypass RCE for SYSTEM on the domain controller.

Barrier is a medium Linux machine built around a Single-Sign-On stack — GitLab, Authentik, and Apache Guacamole. A SAML signature-verification bypass in GitLab (CVE-2024-45409) forges an admin login, CI/CD variables leak a static Authentik API token, and that token lets you impersonate a user and complete Guacamole's SAML SSO programmatically to read a stored SSH key. This post covers recon through user.txt.

A gallery app's genre preference field was vulnerable to second-order SQL injection that dumped admin bcrypt hashes; an undocumented v2 API accepted the raw hash in lieu of a password, granting admin access where a crafted ImageMagick MSL payload wrote a PHP webshell and landed a shell as www-data.

Bamboo is a medium Linux box that opens with an unauthenticated Squid proxy. Scanning through it exposes an internal PaperCut NG 22.0.6 server, vulnerable to CVE-2023-27350 — an authentication bypass chained with print scripting for remote code execution as the papercut user. This post covers recon through the user flag.

MSSQL guest access exposes xp_dirtree, which coerces the SQL service account into an NTLMv2 handshake captured by Responder — cracking the hash and forging a Kerberos silver ticket with the IT group injected into the PAC grants MSSQL sysadmin and xp_cmdshell RCE as signed\mssqlsvc.

LogForge is a Medium Linux box built around the Log4Shell (CVE-2021-44228) vulnerability. Apache reverse-proxies Tomcat, and an Orange-Tsai /..;/ path-normalization trick reaches the otherwise-forbidden manager page, where stock tomcat:tomcat credentials still work. A webapp on Tomcat logs user input with a vulnerable Log4j2, so a crafted ${jndi:...} string in a form field triggers a serialized-gadget deserialization and a shell as tomcat. This post covers recon through the user flag.

Starting with low-privilege domain credentials, a password-locked Excel file on an SMB share is cracked to reveal service account credentials, a WriteSPN misconfiguration enables targeted Kerberoasting of the WinRM account, and a shell is obtained as svc_winrm for the user flag.

Job is a Medium Windows box whose hiring page asks applicants to email their CV as a LibreOffice document to a public mailbox — and a backend service blindly opens every attachment in LibreOffice with macros enabled. That turns an emailed .odt carrying an auto-run Basic macro into remote code execution as a low-privilege user. This post covers recon through the user flag.

CVE-2023-45878 in Gibbon-LMS allowed unauthenticated PHP webshell upload, leading to credential extraction, hash cracking, and Kerberos SSH access as f.frizzle for the user flag.

Compiled is a medium Windows box built around a 'compile my Git repository' web app that clones any URL you submit using a vulnerable Windows Git client. A malicious repo abusing CVE-2024-32002 (symlinked-submodule clone hook) yields a shell as Richard; the Gitea SQLite database then leaks a PBKDF2 hash that cracks to a weak password, granting WinRM access as Emily. This post covers recon through the user flag.

Backfire chains an exposed Havoc C2 SSRF into WebSocket RCE, abuses a second C2 (HardHatC2) with a default JWT secret to move to a service account, and escalates via a passwordless sudo iptables-save arbitrary file write.

Aero is a Medium Windows box built around ThemeBleed (CVE-2023-38146). A public 'Aero Theme Hub' on IIS lets anyone upload a Windows 11 .theme file that an admin then 'tests'. A malicious theme references an .msstyles over SMB; with PACKTHEM_VERSION 999 Windows verifies a signed _vrf.dll and then re-loads it, and a deterministic SMB content-swap turns that signature/load race into RCE as sam.emerson. This post covers recon through the user flag.

Anonymous SMB access exposes 315 Active Directory usernames; one account lacks Kerberos pre-authentication, its cracked AS-REP hash yields credentials that reveal a ForceChangePassword ACE on a second account, whose share access surfaces an LSASS dump containing the NT hash for svc_backup — the account that lands WinRM as the user foothold.

A Laravel blog's password-reset form concatenates the submitted email into a SQL query, so sqlmap dumps the admin's bcrypt hash; the cracked password unlocks an admin panel running a vulnerable encore/laravel-admin, where an extension-only avatar filter is bypassed with a double-extension PHP webshell for remote code execution and the user flag.

The school subdomain's ?view= parameter passed input directly to PHP include(); bypassing its backslash filter with forward slashes pointed it at a UNC path, forcing the web process to authenticate over SMB and handing Responder a Net-NTLMv2 hash for svc_apache that cracked to give the foothold credential.

A Flask booking app reads files by client-supplied path, and a self-hosted Gitea instance leaks the on-disk location of its own SQLite database — chaining the two pulls gitea.db off the box, where a crackable PBKDF2 hash for the developer account doubles as the SSH password.

The bank website's team page leaks employee names that convert to AD usernames; one account has Kerberos pre-authentication disabled, its AS-REP hash cracks offline to `Thestrokes23`, and WinRM access as fsmith delivers the user flag.