In this Art of Vector walkthrough, we take OffSec Proving Grounds Jordak from a quiet two-port scan to full root by chaining CVE-2023-26469 in Jorani — log poisoning plus path traversal for unauthenticated RCE — then abusing a NOPASSWD sudo rule for /usr/bin/env.
In this Art of Vector walkthrough, we take OffSec Proving Grounds PyLoader from a blank terminal to root — starting with a quiet two-port scan, then chaining the exposed pyLoad web UI to CVE-2023-0297 for pre-auth remote code execution.
In this Art of Vector walkthrough, we take OffSec Proving Grounds SPX from a quiet two-port scan to full root by chaining an exposed phpinfo leak, CVE-2024-42007 in php-spx, Tiny File Manager credential recovery, a PHP web shell, password reuse into profiler, and finally a sudo-allowed make install that evaluates attacker-controlled Makefile shell expansion as root.
In this Art of Vector walkthrough, we take OffSec Proving Grounds Workaholic from a blank terminal to root — starting with WordPress recon, then chaining CVE-2024-9796 SQL injection into cracked credentials, FTP access, credential reuse over SSH, and finally a SUID library hijack.
In this Art of Vector walkthrough, we take a lab machine called Twiggy from a blank terminal to full root access — starting with reconnaissance, then pivoting to an exposed SaltStack service and chaining CVE-2020-11651 and CVE-2020-11652 into remote code execution.