Binary Exploitation
JustCTF 2025
🔹 Shellcode Printer: fmt-string write → shellcode drip
🔹 Baby Heap: UAF → tcache poison → libc leak
🔹 Prospector: buffer overflow → ret2linker
Pentathon
NCIIPC-AICTE Pentathon 2025
Qualifier Round
🔹 Placeholder: arbitrary R/W via DOB → exit-handler hijack
🔹 Handout: heap OOB → tcache poison → FSOP ROP
HackTheBox
Cyber Apocalypse 2025
🔹 Quack-Quack: canary leak → ret2win
🔹 Blessing: off-by-one write → read_flag()
🔹 Laconic: stack overflow → SROP → execve
🔹 Crossbow: negative-index write → ROP shell
🔹 Contractor: stack leak → overwrite fn ptr
🔹 Strategist: off-by-one → tcache poison → ROP
Pentesting · Windows
AuthBy
Proving Grounds · FTP creds → JuicyPotato to SYSTEM
August 2025Billyboss
Proving Grounds · Nexus default creds RCE → GodPotato
August 2025Craft
Proving Grounds · ODT macro RCE → GodPotato SYSTEM
August 2025Dvr4
Proving Grounds · DVR traversal → cracked hash, PsExec
August 2025Fish
Proving Grounds · GlassFish traversal leaks flags directly
August 2025Hepet
Proving Grounds · Mail macro → unquoted service path
August 2025Jacko
Proving Grounds · H2 console RCE → SeImpersonate SYSTEM
August 2025Medjed
Proving Grounds · SQLi webshell → BarracudaServer privesc
August 2025Mice
Proving Grounds · Remote Mouse RCE → local exploit
August 2025Nickel
Proving Grounds · Leaked API creds → SYSTEM endpoint
August 2025Shenzi
Proving Grounds · WordPress creds → AlwaysInstallElevated MSI
August 2025Pentesting · Active Directory
Access
Proving Grounds · File upload bypass → kerberoast → SeManageVolume
August 2025Active
HTB · GPP cpassword → kerberoast → DA hash
August 2025Blackfield
HTB · AS-REP roast → Backup Operators → DCSync
August 2025Cicada
HTB · Share creds → Backup Operators → PtH
August 2025Escape
HTB · Leaked SQL creds → ADCS ESC1
August 2025Forest
HTB · Kerberoast → Account Operators → DCSync
August 2025Hokkaido
Proving Grounds · Password spray → targeted kerberoast → Server Operator
August 2025Monteverde
HTB · LDAP creds → Azure AD Connect abuse
August 2025Nagoya
Proving Grounds · GenericAll chain → silver ticket → MSSQL RCE
August 2025Resourced
Proving Grounds · Leaked NTDS dump → RBCD → DCSync
September 2025Sauna
HTB · AS-REP roast → cached creds → DA
September 2025Timelapse
HTB · Cracked pfx cert → LAPS reader
September 2025Vault
Proving Grounds · SMB write → Responder NTLM → GPO abuse
September 2025Pentesting · Linux
Bitforge
Proving Grounds · .git leak → SOPlanning RCE → sudo flask
September 2025Bullybox
Proving Grounds · BoxBilling RCE via leaked git creds
September 2025ClamAV
Proving Grounds · Sendmail/ClamAV exploit → direct root
September 2025Cockpit
Proving Grounds · SQLi bypass → Cockpit console → tar sudo
September 2025Exfiltrated
Proving Grounds · Subrion default creds → exiftool CVE root
September 2025Extplorer
Proving Grounds · WordPress setup abuse → disk group PwnKit
September 2025Fanatastic
Proving Grounds · Grafana traversal → cracked creds → disk group
September 2025Fired
Proving Grounds · Openfire CVE → DB creds leak root
September 2025Flu
Proving Grounds · Confluence RCE → cron script overwrite
September 2025Hetemit
Proving Grounds · Eval RCE → writable config → sudo reboot
September 2025LaVita
Proving Grounds · Laravel RCE → writable cron → composer sudo
September 2025Marketing
Proving Grounds · LimeSurvey RCE → credential chain → sudo
September 2025Mzeeav
Proving Grounds · Magic byte bypass → renamed find binary
September 2025Nukem
Proving Grounds · Plugin upload RCE → DOSBox setuid
September 2025Ochima
Proving Grounds · Maltrail RCE → writable cron script
September 2025PC
Proving Grounds · ttyd terminal → PwnKit root
October 2025Payday
Proving Grounds · CS-Cart RCE → weak SSH password
October 2025Pelican
Proving Grounds · Exhibitor RCE → gcore leaks root pass
October 2025Peppo
Proving Grounds · Plugin upload RCE → DOSBox setuid
October 2025Postfish
Proving Grounds · Phishing → postfix group → mail sudo
October 2025QuackerJack
Proving Grounds · rConfig RCE → find setuid root
October 2025Readys
Proving Grounds · Redis LFI RCE → tar wildcard root
October 2025Scrutiny
Proving Grounds · TeamCity bypass → leaked key → systemctl CVE
October 2025Snookums
Proving Grounds · Photo gallery LFI → writable passwd
October 2025Sorcerer
Proving Grounds · SCP-jailed key → start-stop-daemon root
October 2025SPX
Proving Grounds · Path traversal → cracked hash → makefile sudo
October 2025SpideySociety
Proving Grounds · FTP creds → sudoers service abuse
October 2025Vmdak
Proving Grounds · SQLi/LFI RCE → Jenkins CVE root
October 2025Walla
Proving Grounds · RaspAP RCE → Python library hijack
October 2025WallpaperHub
Proving Grounds · LFI creds leak → happy-dom CVE sudo
October 2025Womb
Proving Grounds · Unauth Redis RCE → root service
October 2025Xposedapi
Proving Grounds · WAF bypass header → wget setuid root
October 2025Zab
Proving Grounds · Terminal foothold → Zabbix creds → rsync sudo
October 2025ZenPhoto
Proving Grounds · Old RCE → PwnKit root
October 2025Zipper
Proving Grounds · LFI via zip wrapper → 7z wildcard root
October 2025