Machine

Bashed is a fairly easy machine which focuses mainly on fuzzing and locating important files. As basic access to the crontab is restricted

This lab emphasizes different enumeration methods, particularly web enumeration, to uncover vulnerabilities. Learners will exploit CVE-2022-25018 for initial access. The lab also teaches privilege escalation techniques to gain higher-level access within the system.

Leverage a misconfigured PostgreSQL database server that is listening on all interfaces with default credentials to gain code execution in this lab. Next, exploit misconfigured SUID permissions on the /usr/bin/find binary for privilege escalation. This approach enhances your skills in identifying misconfigurations and escalating privileges effectively.

In this lab, you will exploit a Local File Inclusion (LFI) vulnerability in an outdated version of CS Cart installed on the PayDay lab. This lab enhances your skills in vulnerability detection, exploitation, and system access techniques.

You are required to leverage enumeration techniques, including web enumeration, to uncover potential vulnerabilities. The lab involves exploiting CVE-2022-26134 and abusing cronjobs to gain unauthorized access. This lab focuses on understanding and exploiting vulnerabilities to enhance security awareness.

In this lab, the RemoteMouse 3.008 exploit will be used on port 1978 for remote code execution, capturing a reverse shell with Netcat. After decoding the FileZilla password, we will log in via Remote Desktop and open a Command Prompt as an administrator. This lab focuses on exploiting service vulnerabilities and privilege escalation methods.

The lab will leverage enumeration techniques, including web enumeration, to uncover potential vulnerabilities. You will also exploit CVE-2021-3129 and demonstrate how to abuse SUDO permissions for unauthorized access. This lab focuses on understanding and exploiting vulnerabilities to enhance security awareness.

To exploit this lab, you’ll leverage credential disclosure on a web application endpoint to gain an initial foothold. This lab helps you understand how to exploit credential disclosures, crack passwords, and bypass firewall protections for privilege escalation.

This lab demonstrates exploiting a remote code execution vulnerability in SmarterMail build 6985 to gain SYSTEM-level access on a Windows server. Learners will identify the application version, leverage an RCE exploit, and use a reverse shell payload to compromise the target. This lab emphasizes web application exploitation and highlights the risks of unpatched software.

In this lab, we will exploit the target through an authenticated file upload bypass vulnerability in Subrion CMS that leads to remote code execution. We will then exploit a root cron job via a script running exiftool every minute.