OffSec Proving Grounds Twiggy — SaltStack CVE-2020-11651 RCE
In this Art of Vector walkthrough, we take a lab machine called Twiggy from a blank terminal to full root access — starting with reconnaissance, then pivoting to an exposed SaltStack service and chaining CVE-2020-11651 and CVE-2020-11652 into remote code execution.