Proving Grounds Portfolio

AccessThis lab demonstrates exploiting a file upload vulnerability in a web application to gain initial access by uploading a .htaccess file and a web shell. Learners escalate privileges by leveraging the svc_mssql account's SeManageVolumePrivilege to gain full control over the C: drive, followed by executing a SYSTEM shell using a Windows Error Reporting (WER) exploit. This lab emphasizes web exploitation, Kerberoasting, and privilege escalation through volume management.
AlgeronThis lab demonstrates exploiting a remote code execution vulnerability in SmarterMail build 6985 to gain SYSTEM-level access on a Windows server. Learners will identify the application version, leverage an RCE exploit, and use a reverse shell payload to compromise the target. This lab emphasizes web application exploitation and highlights the risks of unpatched software.
AssignmentThis lab demonstrates leveraging an administrative account on Gogs to exploit the Git hooks feature, enabling remote code execution (RCE) and achieving initial access as a user. Privilege escalation is achieved by exploiting a command injection vulnerability in a root-executed cron job that uses the find command insecurely. The lab highlights Git-based RCE, cron job enumeration, and command injection for full system compromise.
AuthByThis lab involves exploiting an anonymous FTP server to gain initial access. Learners will enumerate the target to discover credentials for an admin FTP account, then upload a malicious PHP reverse shell for remote execution. The final step involves using the Task Scheduler Privilege Escalation exploit to gain administrative access on the target. This lab focuses on enumeration, credential discovery, web shell deployment, and privilege escalation.
BanzaiThis lab demonstrates exploiting weak FTP credentials to upload a PHP reverse shell to a web root for initial access. Learners will then leverage a misconfigured MySQL server running as root to escalate privileges using a custom User Defined Function (UDF). The lab emphasizes exploiting file upload vulnerabilities, database misconfigurations, and achieving command execution as root.
BillyBossThis lab involves exploiting Sonatype Nexus 3.21.0-05 for authenticated remote code execution and using the SMBGhost vulnerability to escalate privileges. Learners will craft payloads to gain initial access and leverage an unpatched SMB service to obtain a SYSTEM shell. The lab highlights web application vulnerabilities and critical privilege escalation techniques.
BlackGateThis lab demonstrates leveraging an insecure Redis service to gain initial shell access by deploying a rogue server exploit for remote code execution. Privilege escalation is achieved by exploiting a vulnerable redis-status binary using Return Oriented Programming (ROP) to bypass protections and execute arbitrary commands as root. This lab emphasizes exploiting service misconfigurations, binary reverse engineering, and advanced ROP chain development for privilege escalation.
BooleanThis lab demonstrates exploiting a mass assignment vulnerability in a Rails-based application to confirm user accounts, enabling access to the file manager. Learners leverage path traversal through the cwd parameter to upload an SSH public key into the .ssh/authorized_keys file, enabling remote access as the remi user. Privilege escalation is performed by abusing a pre-configured SSH alias to log in as root. This lab highlights web application exploitation, file traversal, and SSH abuse for root access.
ClamAVThis lab demonstrates the exploitation of a remote code execution vulnerability in Sendmail configured with clamav-milter in black-hole mode. Learners will use a public exploit to open a bind shell on the target server, granting root access. This exercise focuses on service enumeration, exploitation of vulnerable configurations, and post-exploitation techniques.
ClueA documented authorized-lab assessment of the Clue Proving Grounds target.
CockpitThis lab demonstrates exploiting a SQL Injection (SQLi) vulnerability in a login page to extract credentials and gain access via SSH. Privilege escalation is achieved by abusing a wildcard bug in a custom SUID binary (AuthChecker), allowing learners to manipulate the cp command to preserve permissions and create a root-owned SUID binary. This lab emphasizes SQLi exploitation, binary analysis, and wildcard-based privilege escalation for root access.
CraftThis lab demonstrates using a VBA macro in an ODT file to gain initial access to a Windows system via a vulnerable resume upload form. Learners will escalate privileges by uploading a PHP web shell to compromise the apache user. The final escalation leverages the SeImpersonatePrivilege permission with the PrintSpoofer tool to execute commands as SYSTEM. This lab highlights code execution via macros, PHP shell deployment, and privilege escalation using impersonation privileges.
CraneThis lab demonstrates exploiting SuiteCRM default credentials and the CVE-2022-23940 Remote Code Execution (RCE) vulnerability to achieve an initial shell as www-data. Privilege escalation is performed by abusing a sudo misconfiguration that allows the service binary to be executed with root privileges. Learners bypass restrictions and spawn a root shell. This lab highlights web application exploitation, RCE chaining, and misconfigured sudo permissions for root access.
DC5In this lab, you will exploit a vulnerable web application by leveraging Local File Inclusion (LFI) and server access log poisoning to achieve remote code execution (RCE). Following the initial compromise, you will escalate privileges to root using a known vulnerability in GNU Screen 4.5.0. This lab highlights skills in enumeration, web application exploitation, RCE, and privilege escalation via local exploits.
DepreciatedThis lab demonstrates exploiting a GraphQL service to enumerate user accounts and retrieve an OTP (One-Time Password) to access a CLI messaging service. Learners will leverage the message creation functionality to overwrite a critical file, gaining admin access. This leads to retrieving the root password from a secure message, allowing SSH access as root. The lab emphasizes API enumeration, file manipulation, and privilege escalation via insecure application logic.
DVR4This lab demonstrates exploiting a Directory Traversal vulnerability in Argus Surveillance DVR 4.0 to access sensitive files, such as SSH private keys and configuration files. Learners will decode the Administrator password using a substitution cipher, then gain elevated privileges by launching a reverse shell through runas with the recovered credentials. The lab emphasizes file inclusion attacks, custom encryption decoding, and privilege escalation through administrative utilities.
Educated 1A documented authorized-lab assessment of the Educated 1 Proving Grounds target.
EducatedThis lab focuses on exploiting an unrestricted file upload vulnerability in Free School Management Software, extracting credentials from a reversed APK file, and escalating privileges to root.
ExfiltratedThis lab demonstrates exploiting an authenticated file upload bypass vulnerability in Subrion CMS 4.2.1 to achieve remote code execution. Learners will escalate privileges by leveraging a root cron job that executes ExifTool against uploaded images, exploiting a vulnerability (CVE-2021-22204) in the DjVu file format. The lab emphasizes web application exploitation, cron job abuse, and privilege escalation through malicious file uploads.
ExtplorerThis lab demonstrates exploiting a file upload vulnerability in eXtplorer to gain a foothold on the system by uploading a PHP web shell. Privilege escalation is performed by abusing the target user’s membership in the disk group, allowing unrestricted access to sensitive system files such as /etc/passwd and /etc/shadow. Learners will crack the root password hash and gain full root access. This lab highlights file upload exploitation, sensitive file abuse, and password cracking for privilege escalation.
FiredThis lab focuses on exploiting CVE-2023-32315, a Path Traversal vulnerability in Openfire's Admin Console. By abusing an unauthenticated setup environment, attackers can bypass authentication, create an admin user, upload a malicious plugin, and achieve Remote Code Execution (RCE). Privilege escalation is achieved by extracting SMTP credentials and gaining root access.
FluIn this lab, learners exploit CVE-2022-26134, a critical Remote Code Execution (RCE) vulnerability in Atlassian Confluence (version 7.13.6). By leveraging OGNL injection, attackers gain initial access to the system, discover misconfigured cron jobs, and escalate privileges to root by manipulating executable scripts.
HeistThis lab demonstrates exploiting a Server-Side Request Forgery (SSRF) vulnerability in a Flask web application to retrieve a Windows NTLMv2 handshake via responder. Learners will crack the password hash, leverage Group Managed Service Accounts (GMSA) to escalate privileges, and abuse the SeRestorePrivilege to overwrite utilman.exe with cmd.exe, achieving SYSTEM-level access via the RDP login screen. The lab highlights SSRF exploitation, GMSA manipulation, and creative privilege escalation techniques.
HepetThis lab demonstrates leveraging leaked credentials to access an email server and send a malicious spreadsheet containing a LibreOffice macro payload. Learners will use the payload to establish a reverse shell and escalate privileges by exploiting a writable service binary for the Veyon Service, ultimately achieving SYSTEM-level access. This lab emphasizes email server exploitation, social engineering, and privilege escalation through service misconfigurations.
HutchThis lab demonstrates leaking user credentials from LDAP to exploit WebDAV on an IIS web server, enabling shell uploads and remote code execution. Learners will escalate privileges by leveraging Microsoft LAPS (Local Administrator Password Solution) to retrieve the Administrator user’s randomized password via LDAP and execute commands as SYSTEM. The lab emphasizes web application exploitation, LDAP enumeration, and leveraging Windows privilege escalation techniques.
ImageThis lab demonstrates exploiting ImageMagick with CVE-2023-34152, which allows Remote Code Execution (RCE) by manipulating image file names containing malicious payloads. Privilege escalation is performed by leveraging a SUID binary (strace) to spawn a root shell. This lab highlights RCE exploitation through misconfigured image processing and privilege escalation using SUID binaries.
InternalA documented authorized-lab assessment of the Internal Proving Grounds target.
JackoThis lab demonstrates exploiting a misconfigured H2 database with default credentials to achieve remote code execution, followed by privilege escalation via a DLL hijacking vulnerability in Fujitsu's PaperStream IP application. Learners will utilize SQL queries to execute commands and leverage an unpatched DLL search path vulnerability to obtain a SYSTEM shell.
JordakThis lab involves exploiting CVE-2023-26469 in Jorani v1.0.0 to achieve Remote Code Execution (RCE). Privilege escalation is achieved through a misconfigured sudo permission for /usr/bin/env, leading to root access.
KevinThis lab focuses on exploiting a buffer overflow vulnerability in HP Power Manager v4.2 Build 7 to achieve remote code execution. Learners will use both a Python-based exploit and a Metasploit module to gain SYSTEM-level access on a Windows 7 machine. The exercise highlights buffer overflow exploitation and the risks of using default credentials.
LavitaThis lab challenges learners to exploit a misconfigured APP_DEBUG setting in a Laravel 8.4.0 application. Using CVE-2021-3129, an unauthenticated Remote Code Execution (RCE) vulnerability in Laravel's Ignition component, attackers can execute arbitrary code, gain reverse shells, and escalate privileges to root through misconfigurations.
LawThis lab demonstrates exploiting HTM LAWED with the CVE-2022-35914 vulnerability to achieve Remote Code Execution (RCE) through an injection in the hhook parameter. Privilege escalation is performed by modifying a writable cron-executed cleanup script, injecting a malicious payload to escalate privileges to root. This lab highlights web exploitation, cron job enumeration, and privilege escalation through script abuse.
MiceThis lab demonstrates exploiting RemoteMouse 3.008 to achieve remote code execution via a modified exploit that delivers a reverse shell. Learners will escalate privileges by extracting and decoding credentials from FileZilla's configuration files, gaining RDP access as a user. Finally, they will exploit the RemoteMouse application's admin privileges to spawn a Command Prompt as Administrator. This lab emphasizes RCE, credential exploitation, and leveraging application misconfigurations for privilege escalation.
MonsterThis lab demonstrates leveraging a weak password to access Monstra CMS, extracting password hashes from its backup system, and cracking them to gain RDP access. Privilege escalation is achieved by exploiting a writable xampp-control.ini file to inject a reverse shell payload, triggered upon interaction with the XAMPP Control Panel by an administrator. This lab emphasizes web application exploitation, credential cracking, and local privilege escalation through misconfigured services.
NagoyaThis lab demonstrates exploiting an MSSQL server running under a privileged service account to achieve domain administrator access. By leveraging the service account's password hash, learners generate a Silver Ticket to impersonate the Administrator user and execute commands. The lab highlights SQL Server enumeration, Kerberos Silver Ticket exploitation, and domain escalation techniques for achieving full system control.
NickelThis lab demonstrates exploiting a credential disclosure in a web application to gain an initial foothold via SSH. Learners will extract credentials from a password-protected PDF to uncover a hidden administrative service, then bypass firewall protections using SSH port forwarding. The lab concludes with executing commands as SYSTEM and deploying a reverse shell, showcasing advanced enumeration, port forwarding, and privilege escalation techniques.
OchimaThis lab demonstrates exploiting an unauthenticated OS command injection vulnerability in Maltrail <= v0.54 during the login process. Learners escalate privileges by modifying a writable backup script (/var/backups/etc_Backup.sh) that is executed by root at regular intervals, resulting in a reverse shell as root. This lab highlights web application exploitation, insecure command execution, and privilege escalation through script abuse.
Pay DayIn this lab, Learners exploit a Local File Inclusion (LFI) vulnerability in the CS-Cart application to access sensitive system files and uncover critical usernames. Using the retrieved information, Learners will brute-force SSH credentials to gain access to the system and escalate privileges to root using a sudo misconfiguration. This exercise enhances skills in web application exploitation, brute-forcing, and privilege escalation.
PCThis lab demonstrates exploiting a Remote Code Execution (RCE) vulnerability in rpc.py (CVE-2022-35411), an ASGI-based RPC framework, to achieve initial access. Privilege escalation is achieved by leveraging the RCE to set the SUID bit on /bin/bash, enabling root access. This lab highlights RPC exploitation, serialized payload crafting using pickle, and SUID abuse for privilege escalation.
PelicanThis lab demonstrates exploiting an unauthenticated command injection vulnerability in the Exhibitor UI for Apache Zookeeper to gain initial access. Learners will escalate privileges by dumping the memory of a root process using the sudo-allowed gcore command to retrieve root credentials. The lab highlights web application vulnerabilities, process memory analysis, and privilege escalation techniques.
PlumThis lab demonstrates exploiting a Remote Code Execution (RCE) vulnerability in PluXml v5.8.7 (CVE-2022-25018) by injecting a malicious PHP payload into a static page. Privilege escalation is achieved by discovering root credentials in the mail directory, enabling direct root access. This lab highlights weak web protections, file upload vulnerabilities, and privilege escalation through credential disclosure.
PressThis lab demonstrates exploiting a Remote Code Execution (RCE) vulnerability in FlatPress v1.2.1 (CVE-2022-40048) through the file upload functionality. Privilege escalation is achieved by leveraging a misconfigured sudo permission for the apt-get command to execute arbitrary code as root. This lab highlights default credentials exploitation, file upload RCE, and privilege escalation using sudo misconfigurations.
ResourcedThis lab demonstrates enumerating a domain controller to identify sensitive files left on an SMB share, leading to credential retrieval and domain access. Learners will leverage Resource-Based Constrained Delegation (RBCD) to impersonate the domain administrator and gain full SYSTEM-level access to the domain controller. This lab emphasizes Active Directory enumeration, constrained delegation abuse, and administrative compromise techniques.
ScrutinyEnumeration methods are utilized to uncover potential vulnerabilities. The lab focuses on exploiting CVE-2024-27198, practicing privilege escalation, and abusing SUDO permissions for unauthorized access. This lab emphasizes understanding and exploiting vulnerabilities to enhance security awareness.
ShenziThis lab involves exploiting credentials found in an open SMB share to gain access to a Wordpress site, which is used to upload a PHP reverse shell for initial access. Learners will escalate privileges using an insecure registry configuration (AlwaysInstallElevated) to install a malicious MSI package and obtain SYSTEM-level access. The lab highlights enumeration, web exploitation, and registry-based privilege escalation techniques.
SlortThis lab demonstrates exploiting a remote file inclusion vulnerability in a web application to execute arbitrary commands and deploy a reverse shell. Learners will escalate privileges by replacing a scheduled executable with a malicious payload, leveraging weak file permissions and an administrative task scheduler. The lab highlights web application vulnerabilities and improper file permission practices.
SnookumsThis lab involves exploiting a Remote File Inclusion (RFI) vulnerability in Simple PHP Photo Gallery v0.8 to gain initial access via a reverse shell. Learners will escalate privileges by uncovering MySQL root credentials and using double-encoded user credentials to SSH into the system. Finally, they will manipulate the /etc/passwd file to create a root-level user. The lab emphasizes web application vulnerabilities, credential reuse, and local privilege escalation techniques.
SpiderSocietyThis hands-on lab immerses learners in a realistic network environment where seemingly secure systems hide critical misconfigurations. Participants will start by enumerating exposed services and identifying weak points in the infrastructure. Using techniques such as service exploitation and credential abuse, learners will gain initial access, escalate privileges, and pivot across the network to access restricted systems. The lab emphasizes core penetration testing skills including enumeration, privilege escalation, and lateral movement—mirroring real-world attack scenarios.
SquidThis lab demonstrates using a Squid proxy to enumerate open ports on a target and gain initial access via phpMyAdmin with default credentials. Learners will escalate privileges by recovering restricted LOCAL SERVICE privileges through scheduled tasks. Finally, they will exploit the SeImpersonatePrivilege using PrintSpoofer to achieve a SYSTEM shell. This lab emphasizes proxy exploitation, privilege recovery, and abuse of impersonation rights.
TwiggyThis lab demonstrates exploiting a pre-auth remote code execution vulnerability in SaltStack Master (CVE-2020-11651). Learners will leverage the SaltStack API to execute arbitrary commands, resulting in a root shell on the target. This lab highlights the risks of unpatched critical vulnerabilities in infrastructure management tools.
WorkaholicThis lab challenges participants to exploit a critical unauthenticated SQL injection vulnerability in the WP-Advanced-Search WordPress plugin (CVE-2024-9796). Learners will begin by performing service enumeration to discover an exposed WordPress instance. Through SQL injection, they will enumerate users and extract password hashes, which are then cracked to gain FTP access. With access to the WordPress directory, participants will retrieve sensitive database credentials from wp-config.php and pivot to SSH access. The final stage involves escalating privileges via a misconfigured SUID binary vulnerable to shared object injection, ultimately granting root access and flag capture. This lab is ideal for ethical hackers, red teamers, and web application security professionals seeking to strengthen their skills in full-chain exploitation. Key skills include SQL injection, password cracking, lateral movement via service credentials, and privilege escalation through binary exploitation. The lab emphasizes the dangers of insecure plugins, poor credential management, and misconfigured binaries in web hosting environments.
ZipperThis lab demonstrates chaining a file upload functionality with Local File Inclusion (LFI) to achieve Remote Code Execution (RCE). Learners escalate privileges by exploiting a cron job that uses the 7z utility with a wildcard *.zip parameter, allowing arbitrary file reading via symbolic link manipulation. This lab highlights chained web vulnerabilities, wildcard abuse, and cron job exploitation for root access.