Tag
This was a pretty easy Linux box that involved exploiting an SQL injection vulnerability affecting the OpenDocMan web application to gain initial access, and exploiting a Kernel Exploit affecting Ubuntu to gain root.
Read moreThis was an easy Windows box that involved exploiting a WebDAV buffer overflow vulnerability present in IIS version 6 and using a vulnerability in the windows WMI service to escalate privileges.
Read moreI really enjoyed this box, even though the initial exploitation phase isn’t something new as it exploits the EternalBlue vulnerability, but it then shows how to convert a normal shell to a Meterpreter shell, how to migrate to a SYSTEM level process and how to dump and crack user hashes.
Read moreThis was a very peculiar box, as it involved sending a password change link to a user from a web application in order to reset his password, uploading a PHP shell via SMB to gain remote code execution and therefore a shell, and using a password found in the underlying system’s bash history file to login as the administrator user
Read moreThis was a very easy box, as it involved logging into the Tomcat Web Application Manager using default credentials, deploying a new application using a malicious .war Java reverse shell and gaining a reverse shell by navigating to it.
Read moreThis was an easy Windows machine that involved exploiting a directory traversal vulnerability in the Adobe ColdFusion web application to obtain user hashes, cracking them with an online hash lookup tool and using a scheduled task to gain remote access. Privilege escalation was possible through a Windows Kernel Exploit.
Read moreThis room is part of the TryHackMe’s Offensive Pentesting learning path, which is something a lot of people use when preparing for their OSCP exam. This was one of the first rooms and it involved attacking a web application exploiting a file upload functionality, bypassing file extension whitelisting, and exploiting a SUID binary to escalate privileges.
Read moreThis was an intermediate box that involved decoding a base64-encoded password to access a file upload page, through which a PHP reverse shell can be uploaded to gain an initial access. From there, a password has to be de-ciphered using ROT13 in order to obtain root access to the machine.
Read moreThis is a fairly easy box that requires you to exploit the Eternal Blue vulnerability(CVE-2017-0143, fixed with the MS17-010 Microsoft update) in the SMB service(specifically version 1), which allows execution of code remotely.
Read more