| Nº | NAME | PLATFORM | DIFF | DATE | TAGS | LANG |
|---|---|---|---|---|---|---|
| 012 | vault | PG | HARD | 2025-02-20 | windows · active-directory · smb · ntlm-theft · responder · hashcat · genericwrite · gpo-abuse · sharphound · bloodhound | en·es |
| 011 | editor | HTB | EASY | 2025-02-17 | linux · xwiki · cve-2025-24893 · suid · cve-2024-32019 · rce · credentials-exposure | en·es |
| 010 | resourced | PG | MEDIUM | 2025-02-12 | windows · active-directory · ntds-dit · pass-the-hash · genericwrite · rbcd · bloodhound · kerberos | en·es |
| 008 | heist | PG | HARD | 2025-02-10 | windows · ssrf · ntlm-relay · responder · gmsa · serestoreprivilege · utilman · bloodhound · active-directory | en·es |
| 009 | nagoya | PG | HARD | 2025-02-10 | windows · active-directory · genericall · kerberoasting · silver-ticket · mssql · seimpersonateprivilege · printspoofer | en·es |
| 007 | hokkaido | PG | MEDIUM | 2025-02-05 | windows · active-directory · mssql · kerberoasting · sebackupprivilege · pivoting · bloodhound | en·es |
| 006 | slort | PG | MEDIUM | 2025-02-01 | windows · rfi · lfi · file-inclusion · php · scheduled-task · msfvenom | en·es |
| 005 | hutch | PG | MEDIUM | 2025-01-30 | windows · ldap · information-disclosure · webdav · laps · active-directory | en·es |
| 004 | kevin | PG | EASY | 2025-01-25 | windows · hp-power-manager · buffer-overflow · metasploit · cve-2009-3999 | en·es |
| 003 | internal | PG | EASY | 2025-01-20 | windows · smb · ms09-050 · metasploit · legacy-windows · rce | en·es |
| 002 | intentions | HTB | HARD | 2024-08-15 | linux · sqli · api-manipulation · imagick · git · side-channel · capabilities | en·es |
| 001 | sau | HTB | EASY | 2023-12-10 | linux · request-baskets · cve-2023-27163 · ssrf · maltrail · command-injection · systemctl | en·es |
- №012 PG
Vault
Guest SMB write access exploited via malicious LNK file to capture NTLMv2 hash; cracked for WinRM foothold, then GenericWrite on Default Domain Policy abused with SharpGPOAbuse for admin.
HARD - №011 HTB
Editor
Exploiting XWiki (CVE-2025-24893) for RCE and privilege escalation via SUID abuse on ndsudo (CVE-2024-32019).
EASY - №010 PG
Resourced
Credentials leaked in LDAP description field give access to ntds.dit backup; hashes dumped for WinRM foothold, then RBCD attack via GenericWrite on DC for SYSTEM.
MEDIUM - №008 PG
Heist
SSRF for NTLM hash capture with Responder, GMSA password reading for lateral movement, and SeRestorePrivilege Utilman binary hijack for SYSTEM.
HARD - №009 PG
Nagoya
Multi-stage attack chain in AD: username harvesting, password spraying, GenericAll abuse, Silver Ticket forgery for MSSQL, and SeImpersonatePrivilege exploitation.
HARD - №007 PG
Hokkaido
Multi-stage pivoting in a Windows AD environment: from SMB share discovery to MSSQL impersonation, Targeted Kerberoasting, and SeBackupPrivilege abuse.
MEDIUM - №006 PG
Slort
RFI vulnerability exploitation for foothold as rupert, then replacing a scheduled TFTP.EXE binary with an msfvenom payload to escalate to administrator.
MEDIUM - №005 PG
Hutch
Information disclosure in LDAP description fields for foothold, WebDAV exploitation, and LAPS password retrieval for SYSTEM.
MEDIUM - №004 PG
Kevin
Exploitation of HP Power Manager 4.2 via a buffer overflow (CVE-2009-3999) for immediate SYSTEM access.
EASY - №003 PG
Internal
Exploitation of the MS09-050 SMBv2 vulnerability for immediate remote code execution as NT AUTHORITY\\SYSTEM.
EASY - №002 HTB
Intentions
Leverage SQL injection for authentication bypass, exploit PHP Imagick for RCE, recover hardcoded Git credentials, and perform a side-channel attack using file capabilities.
HARD - №001 HTB
Sau
Exploiting Request Baskets 1.2.1 SSRF (CVE-2023-27163) chained with Maltrail v0.53 command injection for RCE, and privilege escalation via sudo abuse on systemctl.
EASY
no files match the current excavation filters.