Brainpan 2
Run from Parrot OS. A custom service leaks its PATH, a popen call is hijacked through a writable working dir for a foothold, then a maze of decoys — two fake-root accounts, a SUID BOF, and an Exim rabbit hole — before real uid 0 falls to a stale SSH backup key reached through a second SUID service.
Hacker Kid
A page_no parameter leaks a vhost, a DNS zone transfer confirms it, an XXE in a hand-built XML form reads a password, and Tornado SSTI gives a shell. Root comes from a lone cap_sys_ptrace capability on python2.7 — shellcode injected straight into a root process. No kernel exploit.
SQLi — Oracle version
A category filter that concatenates input into SQL. A quote breaks out, a two-column UNION shaped around Oracle's FROM-is-mandatory rule pulls the version banner from v$version, and the whole thing lands in a single curl.
pentest.lab — RBCD
The domain controller already fell — now a domain-joined Windows 11 client. A low-priv user abuses a GenericAll ACL and the default machine-account quota to run Resource-Based Constrained Delegation: add a computer, write one attribute to Active Directory, and S4U to local admin. No exploit.
pentest.lab
A domain built from scratch, then owned the way real ones fall — AS-REP roasting and Kerberoasting for credentials, WinRM on an over-privileged service account, a DCSync of the krbtgt hash, and a forged Golden Ticket to SYSTEM on the DC. No exploit, pure Kerberos abuse.
Brainpan 1
A custom Windows service hands out its own binary over HTTP; static reverse engineering derives a 32-bit stack overflow with no debugger, a reverse shell lands as puck under Wine, and a sudo man-pager escape gives up root.
VulnOSv2
A hidden OpenDocMan install betrays a SQL injection that hands over a MySQL-root FILE primitive and a crackable hash, SSH opens on the reused password, and a 2014 Ubuntu kernel folds to an overlayfs local root.
Symfonos 1
An anonymous Samba share leaks a password, a hidden WordPress install exposes a site-editor LFI, SMTP mailbox poisoning turns that read into RCE, and a SUID binary's relative curl call gives up root via a PATH hijack.
Mr-Robot
robots.txt disclosure to a WordPress credential brute with the site's own leaked wordlist, a theme-editor shell, an unsalted-MD5 crack to pivot users, and a SUID nmap to root. All three keys.
DevGuru
An exposed .git repo and a public Adminer console cascade into an October CMS takeover and PHP RCE — then PwnKit to root when the intended Gitea git-hook path was locked down.
Breach 1.0
Credentials leaking everywhere — a keystore cracked to an RSA key, a hand-decrypted RC4 TLS capture, a pure-Python Tomcat deploy, and PwnKit to root. Two self-built TLS tools where OpenSSL refused to speak.
Pinky's Palace v3
Drupalgeddon2 to root across four users — a library hijack, a hand-built SUID format-string exploit, and a sudo-insmod kernel module. No Metasploit.