In this Art of Vector walkthrough, we take OffSec Proving Grounds Osaka from a sparse Windows port map to full administrator desktop access by chaining a custom FTP stack buffer overflow (WinDbg + Mona, ASLR leak, ROP, and VirtualProtect), then escalating with SeDebugPrivilege and psgetsys parent-process token theft to create a local admin account for RDP.

In this Art of Vector walkthrough, we take OffSec Proving Grounds Symbolic from a two-port Windows web host to Administrator over SSH by recovering a leaked private key from a generated PDF, then chaining an Object Manager symbolic link with James Forshaw's CreateSymlink.exe to steal the administrator's id_rsa. We also note SeTcbPrivilege and the textbook tcb.exe path — documented for context, but not what worked in this run.

In this Art of Vector walkthrough, we take OffSec Proving Grounds Nagoya from a full Active Directory port map to SYSTEM by chaining employee username harvesting, seasonal password spraying, SYSVOL credential recovery, Kerberoasting, helpdesk password resets, MSSQL xp_cmdshell, and PrintSpoofer.

In this Art of Vector walkthrough, we take OffSec Proving Grounds Jordak from a quiet two-port scan to full root by chaining CVE-2023-26469 in Jorani — log poisoning plus path traversal for unauthenticated RCE — then abusing a NOPASSWD sudo rule for /usr/bin/env.

In this Art of Vector walkthrough, we take OffSec Proving Grounds Plum from initial recon to full root access by abusing default admin credentials in PluXml, weaponizing template editing for command execution, and pivoting from a web shell to mailbox credential reuse.

In this Art of Vector walkthrough, we take OffSec Proving Grounds PyLoader from a blank terminal to root — starting with a quiet two-port scan, then chaining the exposed pyLoad web UI to CVE-2023-0297 for pre-auth remote code execution.

In this Art of Vector walkthrough, we take OffSec Proving Grounds SPX from a quiet two-port scan to full root by chaining an exposed phpinfo leak, CVE-2024-42007 in php-spx, Tiny File Manager credential recovery, a PHP web shell, password reuse into profiler, and finally a sudo-allowed make install that evaluates attacker-controlled Makefile shell expansion as root.

In this Art of Vector walkthrough, we take OffSec Proving Grounds Workaholic from a blank terminal to root — starting with WordPress recon, then chaining CVE-2024-9796 SQL injection into cracked credentials, FTP access, credential reuse over SSH, and finally a SUID library hijack.

In this Art of Vector walkthrough, we take a lab machine called Twiggy from a blank terminal to full root access — starting with reconnaissance, then pivoting to an exposed SaltStack service and chaining CVE-2020-11651 and CVE-2020-11652 into remote code execution.