OffSec Proving Grounds Plum — PluXml Default Creds to Root
In this Art of Vector walkthrough, we take OffSec Proving Grounds Plum from initial recon to full root access by abusing default admin credentials in PluXml, weaponizing template editing for command execution, and pivoting from a web shell to mailbox credential reuse.