Operation Promotion Walkthrough
You are up for promotion at Hadron Security. Your senior lead, Mara, has handed you a solo engagement against RecruitCorp, a small recruiting firm with a public-facing portal.
Tagged “Privilege Escalation”
10 entries tagged “Privilege Escalation”. Browse all tags
All entries
WinPEAS
A practical WinPEAS guide: get the Windows privilege-escalation enumerator onto a target, read its color-coded output, focus on the high-signal findings, and avoid drowning in noise.
Pspy
The pspy quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Transfer the static binary, watch processes and cron fire in real time without root, catch a UID=0 root timer, save and grep the feed for root commands, and turn a writable cron script into a privilege-escalation lead.
PowerUp
A practical PowerUp guide: run the PowerSploit Windows privesc auditor, read its check output honestly, focus on the high-signal service and path findings, and keep it lab-safe.
LinPEAS
The LinPEAS quick reference: the flags that matter, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Deliver the script to a target, run and save a clean no-color report, tune the depth (stealth, all-checks, extra, regex), scope checks by group or MITRE technique, grep the high-signal findings, and read the color legend honestly.
LinEnum
The LinEnum quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Deliver the script to a foothold, run default vs thorough, hunt keywords, export files, write a report, and read the sudo, SUID/SGID, cron, and creds sections that matter.
Mr Robot Walkthrough
The Mr. Robot virtual machine (VM) is an exciting challenge inspired by the hit TV series Mr. Robot. It features three hidden keys, progressively increasing in difficulty.
DriftingBlues 5 Walkthrough
WordPress user enumeration via wpscan plus SSH brute-force gain a foothold, then a cracked KeePass database yields a filename that triggers a root cron job for root credentials.
DriftingBlues 4 Walkthrough
Layered web encoding (Base64/Brainfuck/QR) leaks usernames for FTP brute-force, an SSH key upload yields a shell, then a PATH-hijacked SUID binary gives root.
DriftingBlues 2 Walkthrough
A WordPress login brute-forced with wpscan plants a PHP reverse shell in a theme's 404.php, then passwordless sudo nmap escalates to root.