Linux box with anonymous SMB access revealing usernames. Brute forced SSH credentials, discovered encrypted SSH private key for lateral movement, and cracked key passphrase to access higher-privile...

Linux box with custom TLS services. Retrieved client certificates from credential distribution service, authenticated as multiple users through TLS client auth, and escalated via sudo abuse of cert...

Linux box with multiple paths to root. Method 1 uses SSH brute force and sudo less abuse. Method 2 leverages steganography to extract credentials and sudo nano exploitation. Method 1: SSH Brute Fo...

Linux box with multiple vulnerable services. vsftpd backdoor is filtered, but Samba 3.0.20 username map script command injection provides immediate root access. Initial Enumeration Nmap Scan sudo...

Linux box running Elastix VoIP system vulnerable to LFI. Extracted credentials from configuration files and gained root via SSH with deprecated cryptographic algorithms. Initial Enumeration Port ...

Windows XP box vulnerable to MS08_067 SMB exploit providing immediate SYSTEM access without privilege escalation. Enumeration Scanned for SMB vulnerabilities: sudo nmap -T5 -sS -sV --script=smb-v...

Windows 7 machine running vulnerable Icecast server. Exploit chain includes buffer overflow, UAC bypass, process migration, and credential dumping with Mimikatz. Initial Enumeration Port Scan Ru...