Skip to main content

We use cookies to ensure you get the best user experience. For more information see our cookie policy.

Rubber Stamp

From IIS to Domain Admin. Chain a seemingly minor web flaw into a full network takeover.

Task 1: Task 1

During a routine security assessment, analysts discovered an exposed approvals-automation startup still running its original production stack, exposed to the internet. Rubberstamp was built to route internal approval requests automatically, but critical security misconfigurations were never addressed before go-live.

Your task is to enumerate the service, identify any weaknesses, and escalate all the way to Domain Admin.

Please wait 2-3 minutes for the machine to fully boot.

Answer the questions below

  1. What is the user flag?

  2. What is the root flag?

Room Icon

Rubber Stamp

From IIS to Domain Admin. Chain a seemingly minor web flaw into a full network takeover.

hard

60 min

98

User profile photo.
User profile photo.

To access material, start machines and answer questions login.

Score updated
Score updated

Set up your virtual environment

To successfully complete this room, you'll need to set up your virtual environment. This involves starting both your AttackBox (if you're not using your VPN) and Lab Machines, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.
Attacker machine
Status:Off
Lab machine
Status:Off

During a routine security assessment, analysts discovered an exposed approvals-automation startup still running its original production stack, exposed to the internet. Rubberstamp was built to route internal approval requests automatically, but critical security misconfigurations were never addressed before go-live.

Your task is to enumerate the service, identify any weaknesses, and escalate all the way to Domain Admin.

Please wait 2-3 minutes for the machine to fully boot.

Answer the questions below

What is the user flag?

What is the root flag?