An assume-breach Windows AD box where a writable SMB share lets you plant a malicious .library-ms ZIP (CVE-2025-24071) to coerce a user's NetNTLMv2 hash; cracking it and abusing a GenericAll/GenericWrite ACL chain via shadow credentials yields a service account with WinRM access and the user flag.

A product category filter is injectable, but the UNION query has only one string-typed column. Concatenating username and password into that single column dumps every credential and solves the lab.

A TCP scan shows only SSH, but a UDP scan reveals an IKE/IPsec VPN and an unauthenticated TFTP server; the TFTP config leaks a username, an IKE Aggressive Mode scan leaks the Pre-Shared Key hash, and cracking it offline yields an SSH password reused for the user flag.

Bounty exploits an IIS 7.5 upload page that permitted .config files — uploading a crafted web.config with an ISAPI handler mapping executed VBScript as Classic ASP, landing a shell as bounty\merlin.

A publishing site's book-cover URL field is fetched server-side with no SSRF protection, letting us reach an internal API on localhost:5000 whose authors endpoint leaks plaintext SSH credentials for the user flag.

Adobe ColdFusion 8 on port 8500 exposed a null-byte file upload vulnerability (CVE-2009-2265) in its bundled FCKeditor component, allowing a JSP webshell to be planted and executed as the tolis service account.

An unauthenticated Groovy injection in XWiki's SolrSearch endpoint (CVE-2025-24893) gives code execution as the xwiki service user; the Hibernate config leaks a cleartext database password that the local user oliver reuses for SSH, yielding the user flag.

Beep is an easy Linux box running Elastix where a path traversal flaw in vtigerCRM's graph.php leaks /etc/amportal.conf containing a plaintext password that is reused for root SSH, giving immediate full access.

An exposed .git directory on a Backdrop CMS site leaks the database password, which is reused for a CMS admin account; an authenticated module-upload (CVE-2022-42092) drops a PHP webshell for code execution, and the same password reused once more grants SSH as a local user for the user flag.

A guest SMB session reads a logon script left on SYSVOL that leaks a domain password; GenericWrite enables a targeted Kerberoast for WinRM access; unconstrained delegation with PrinterBug coercion captures the DC's TGT for a full DCSync.

Nibbleblog 4.0.3 was running with default credentials and an authenticated unrestricted file upload vulnerability (CVE-2015-6967) in the My Image plugin allowed uploading a PHP webshell that gave code execution as nibbler.

An exposed Spring Boot Actuator endpoint leaks a live admin session ID for instant dashboard access, an unsanitised username field in a patching form yields command injection (bypassing a whitespace filter with ${IFS}), and hardcoded PostgreSQL credentials inside the application JAR give up a bcrypt hash that cracks to a password reused by a local user for SSH.

An Apache web server with CGI enabled served a bash-based script at /cgi-bin/user.sh on a host running unpatched Bash, so injecting the Shellshock payload (CVE-2014-6271) into the User-Agent header returned a reverse shell as user shelly.

A guest-readable SMB share leaks a default new-hire password, RID-cycling enumerates the domain user list, and a password spray plus credentials chained through an AD description field and a hard-coded backup script lands a WinRM shell and the user flag.

A PHP webshell left in a publicly-accessible /dev/ directory on an Apache server provided unauthenticated command execution as www-data, landing the user flag without any authentication.

A Flask app exposes its Searchor 2.4.0 version in the footer; the library feeds user input straight into eval(), so a crafted search query yields command execution as svc, and plaintext credentials in the app's .git/config give a stable SSH shell and the user flag.

Apache Tomcat's Manager interface was exposed with default credentials (tomcat:s3cret), allowing upload of a malicious WAR file that executed a reverse shell directly as NT AUTHORITY\SYSTEM.

An exposed Apache ActiveMQ 5.15.15 OpenWire broker is vulnerable to CVE-2023-46604, an unauthenticated deserialization flaw that instantiates a Spring ClassPathXmlApplicationContext from an attacker-hosted XML file to run a reverse shell as the activemq user.

A product category filter concatenates user input directly into SQL. A UNION SELECT against the users table dumps plaintext credentials, and logging in as administrator solves the lab.

A Dolibarr CRM hidden behind a virtual host accepts default admin credentials and is vulnerable to CVE-2023-30253, where an uppercase