Puppy is a medium Windows machine. This is a grey box machine with a supplied credential. With the credential, we can take advantage of GenericWrite to get access to specific shares. Then, we found a KeePass database file that contains a valid credential for another user account. This user account has GenericAll to another user account that belongs to the Remote Management Users group. There will be a backup file that contains another credential inside the machine. Using the credential, we found a saved credential in the DPAPI that contains a credential for administrative user account.

404Gh0stMay 30, 20258 min read

• Windows
• Medium
• GenericWrite
• GenericAll
• DPAPI

Environment is a Linux machine. The box involves exploiting a Laravel web application vulnerability (CVE-2024-52301) to bypass authentication and upload a shell. It involves finding and decrypting a GPG backup file to obtain credentials, and finally escalating privileges to root by abusing sudo permissions and the BASH_ENV variable.

404Gh0stMay 4, 20255 min read

• Linux
• Medium
• CVE-2024-52301
• Laravel
• File Upload
• GPG
• BASH_ENV

TheFrizz is a medium Windows machine. The box involves attacking a domain controller using Kerberos authentication, abusing Group Policy Objects (GPO), and leveraging the Recycle Bin. The attack path includes exploiting CVE-2023-45878 on Gibbon LMS, obtaining credentials, manipulating GPO settings, and finally achieving system access.

404Gh0stMarch 17, 20259 min read

• Windows
• Medium
• Active Directory
• Kerberos
• Gibbon LMS
• Recycle Bin
• GPO

Cypher is a medium-difficulty box that demonstrates Cypher injection, JAR file reversing, and privilege escalation through bbot.

404Gh0stMarch 2, 20255 min read

• Linux
• Medium
• Cypher Injection
• Neo4j
• bbot