PTG Superid - Linux Privilege Escalation
Box: PTG Superid Vulnerability: SGID Abuse (/usr/bin/sed) Flag: ctf{su!d_b!n4r!es_4r3_b4d_f0r_s3cur!ty} 1. Initial Recon We are given a username, an SSH key, and an endpoint to connec...
Pentest Journeys
PTG Sudoers - Linux Privilege Escalation
Box: PTG Sudoers Vulnerability: Sudo Abuse (NOPASSWD execution of /usr/bin/less) Flag: ctf{!ns3cur3_sud0} 1. Initial Recon We are given an SSH key and an endpoint to connect to. We ca...
Privilege Escalation Lab1 - Linux Git Pager Abuse
Box: Privilege Escalation Lab1 Vulnerability: Sudo Abuse via Git core.pager misconfiguration Flag: ctf{esc4l4t!ng_pr!v!l3g3s} 1. Initial Recon We are provided with a downloadable ZIP ...
MailJail
CVE-2025-49113 — Roundcube RCE → LD_PRELOAD SUID PrivEsc Phase 1 — Recon nmap -sC -sV -p21,8080 <TARGET_IP> Anonymous FTP and Roundcube webmail on 8080. Phase 2 — Anonymous FTP → KeePass D...
DPAPI Privilege Escalation Walkthrough (dpp)
Target: 172.31.35.83 Category: Windows Escalation 1. Recon / Port Scan Scan all ports: nmap 172.31.35.83 -p- --min-rate 5000 -T4 Then perform service detection: nmap 172.31.35.83 -sV -sC...
RedPill
Unauthenticated Redis RCE → Writable Cron Script Phase 1 — Recon nmap -sC -sV <TARGET_IP> Redis is exposed unauthenticated on 6379. Phase 2 — Confirm Unauthenticated Access redis-cli -h &l...
SUID/SGID Exploitation Report (suid)
Target: cc1.pentestgarage.com:3327 Service: SSH Status: COMPLETED - Flag Captured 1. Executive Summary Exploited misconfigured SGID binary (/usr/bin/find) to escalate privileges and acce...
R0b0c0rp (CVE-2021-4034)
CVE-2021-4034 — PwnKit via SSH Brute Force from PDF OSINT Phase 1 — Recon nmap -sC -sV <TARGET_IP> FTP (21, anonymous) and SSH (22) are open. Phase 2 — Anonymous FTP + PDF OSINT ftp <TA...
NFS Privilege Escalation - CTF Writeup (no-files-shared)
During the reconnaissance phase, an Nmap scan was performed against the target system. 1. Port Scanning The scan revealed multiple open ports: 22/tcp → SSH 25/tcp → SMTP 111/tcp → RPCBind ...
Provision
Command Injection (Flask ping utility) → Root Key via Cron Phase 1 — Recon nmap -sC -sV <TARGET_IP> Port 8080 hosts a Flask HR diagnostic tool. Phase 2 — robots.txt Enumeration curl -s htt...