LXD Group Privilege Escalation - CTF Writeup (lxddd)
Target: 172.31.29.235 User: user / user Category: Linux Privilege Escalation Vulnerability: LXD group membership (lxd) 1. Summary A non-privileged user belonging to the lxd Unix group ...
Pentest Journeys
Subm1t4T1ck3t
PHP Webshell via PNG Upload (SetHandler bypass) → Writable Cron Phase 1 — Recon nmap -sC -sV <TARGET_IP> Apache/PHP support portal at /support/index.php. Phase 2 — Credential Discovery cur...
Cronman - Linux Privilege Escalation via World-Writable Cron Script
Box: Cronman IP: 172.31.26.245 Initial Access: user:user (SSH) Vulnerability: World-writable cron script running as root Flag: ctf{Teed2aic2aiGoikiej7ayahn0aimoh3m} 1. Initial Reco...
LogiX
Unrestricted File Upload → PHP RCE Phase 1 — Recon nmap -sC -sV <TARGET_IP> Apache/PHP on port 80, gallery portal at /gallery/. Phase 2 — Explore the Upload Form The gallery index.php lets...
GraSSHopper
SSH Credential Leak + Root Private Key Reuse Phase 1 — Recon nmap -sC -sV <TARGET_IP> Apache (80) and SSH (22) are open. Phase 2 — Web Enumeration Browse the site and check for exposed dir...
Docker Lab 4 - Escaping an Exposed Docker Container (Docker 4)
1. Summary This lab exposes the Docker Engine API on TCP port 2375 without authentication. That is enough to fully compromise the host, because the Docker daemon is effectively root on the machine....
FaultyJail (CVE-2025-4123)
CVE-2025-4123 — build script not yet supplied; foothold/privesc TBD Status The build.sh for this box (FaultyJail / CVE-2025-4123.zip) hasn’t been uploaded yet, so the exact foothold and privesc ch...
Docker docker escape CTF (Docker 3)
Target IP: 13.201.39.153 1337 1. Initial Access nc 13.201.39.153 1337 2. Check the Docker socket ls -l /var/run/docker.sock 3. Check available tools which python3 4. Verify Do...
FaultyLine (CVE-2021-41773)
CVE-2021-41773 / CVE-2021-42013 — Apache 2.4.49 Path Traversal + RCE Phase 1 — Recon nmap -sC -sV -p8080 <TARGET_IP> Banner confirms Apache/2.4.49 on port 8080. Phase 2 — Path Traversal (C...
Docker 2 - Write-Up
1. Initial Reconnaissance The challenge begins with basic enumeration. Running an Nmap scan reveals that port 1337 is open on the target machine. This indicates a potential service that may allow ...