Machine Name: Noter
IP: 10.10.11.140
Difficulty: Medium
Noter is a machine that expects basic enumeration to lead to session cookies, JWT secrets, and credentials to servers. It teaches code review, and identification of code injections. Privilege Escalation was fairly simple as it was achieved with a public exploit that required credentials obtained during enumeration. The exploit allowed command execution as root through MySQL to gain a root shell.
Read More
Machine Name: Late
IP: 10.10.11.156
Difficulty: Easy
Late has an interesting way of exploiting Server Side Template Injection (SSTI) through image to text conversion. Once an image payload that is recognized well by the application is executed, we obtain a user level shell. To escalate privileges, simple enumeration leads to an interesting file run by root. With some understanding of file attributes, it is easy enough to run code as root to get root privileges.
Read More
Machine Name: Paper
IP: 10.10.11.143
Difficulty: Easy
Paper is a relatively easy box and teaches enumeration and a bit of reading API documentations. It forces the attacker to keep looking for sensitive information that can be utilized to run commands and eventually get a shell. To get a user shell, we find credentials on the system through a chat bot. They can be used for logging in through SSH. Another way was to find a command hidden from the ones listed by the bot by reading the API documentation or finding a scripts directory to run commands as user and get a shell. Escalating privileges as root was simple as it was vulnerable to a popular vulnerability with a simple PoC.
Read More
IP: 10.10.10.204
Difficulty: Easy
Summary: Omni is a Windows Box that is pwned using Windows Device Portal exploit. Post-exploitation, enumeration of files leads to discovery of PSCredential Object and decoding it to gain root flag.
Read More
IP: 10.10.10.209
Difficulty: Easy
Summary: Doctor is a Linux Box that can be exploited using Server Site Template Injection (SSTI) or Cross Site Request Forgery (CSRF). The escalated Splunk service is exploited to escalate privileges to root by using Splunk 8.0.5 exploit.
Read More