Skip to main content

We use cookies to ensure you get the best user experience. For more information see our cookie policy.

harder

Real pentest findings combined

Task 1: Hack your way and try harder

The machine is completely inspired by real world pentest findings. Perhaps you will consider them very challenging but without any rabbit holes. Once you have a shell it is very important to know which underlying linux distribution is used and where certain configurations are located.

Hints to the initial foodhold: Look closely at every request. Re-scan all newly found web services/folders and may use some wordlists from seclists (https://tools.kali.org/password-attacks/seclists). Read the source with care.

Edit: There is a second way to get root access without using any key...are you able to spot the bug?

Answer the questions below

  1. Hack the machine and obtain the user Flag (user.txt)

  2. Escalate your privileges and get the root Flag (root.txt)

Room Icon

harder

Real pentest findings combined

medium

75 min

6,149

User profile photo.

To access material, start machines and answer questions login.

Score updated
Score updated

Set up your virtual environment

To successfully complete this room, you'll need to set up your virtual environment. This involves starting both your AttackBox (if you're not using your VPN) and Lab Machines, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.
Attacker machine
Status:Off
Lab machine
Status:Off

The machine is completely inspired by real world pentest findings. Perhaps you will consider them very challenging but without any rabbit holes. Once you have a shell it is very important to know which underlying distribution is used and where certain configurations are located.

Hints to the initial foodhold: Look closely at every request. Re-scan all newly found web services/folders and may use some wordlists from seclists (https://tools.kali.org/password-attacks/seclists). Read the source with care.

Edit: There is a second way to get root access without using any key...are you able to spot the bug?

Answer the questions below
Hack the machine and obtain the user Flag (user.txt)

Escalate your privileges and get the root Flag (root.txt)