Writeups

Compiled: enumerate the AD surface, abuse the exposed credential or delegation path, and escalate to Administrator.

Union: enumerate the services, turn the exposed weakness into a shell, and escalate to root.

Jarmis: use CVE-2021-38647 where it fits the service, gain a shell, and escalate to root.

Lantern: use CVE-2022-38580 where it fits the service, gain a shell, and escalate to root.

Resource: turn the exposed service into a shell, pivot through the container boundary, and escalate to root.

YPuffy: enumerate the AD surface, abuse the exposed credential or delegation path, and escalate to Administrator.

Brains: use CVE-2024-27198 where it fits the service, gain a shell, and escalate to root.

Help: enumerate the AD surface, abuse the exposed credential or delegation path, and escalate to Administrator.

GoodGames: turn the exposed service into a shell, pivot through the container boundary, and escalate to root.

Valentine: use CVE-2014-0160 and CVE-2016-5195 where it fits the service, gain a shell, and escalate to root.

Yummy: enumerate the services, turn the exposed weakness into a shell, and escalate to root.

EvilCUPS: use CVE-2024-47076 and CVE-2024-47175 where it fits the service, gain a shell, and escalate to root.

Prioritise: enumerate the services, turn the exposed weakness into a shell, and escalate to root.

Pyrat: enumerate the services, turn the exposed weakness into a shell, and escalate to root.

Cicada: enumerate the AD surface, abuse the exposed credential or delegation path, and escalate to Administrator.

Gobox: enumerate the services, turn the exposed weakness into a shell, and escalate to root.

Bashed: enumerate the services, turn the exposed weakness into a shell, and escalate to root.

Shocker: use CVE-2014-6271 where it fits the service, gain a shell, and escalate to root.

TwoMillion: use CVE-2023-0386 where it fits the service, gain a shell, and escalate to root.

Soccer: enumerate the AD surface, abuse the exposed credential or delegation path, and escalate to Administrator.

GreenHorn: use CVE-2023-50564 where it fits the service, gain a shell, and escalate to root.

BoardLight: use CVE-2022-37706 and CVE-2023-30253 where it fits the service, gain a shell, and escalate to root.

Editorial: enumerate the services, turn the exposed weakness into a shell, and escalate to root.

PermX: use CVE-2023-4220 where it fits the service, gain a shell, and escalate to root.

Headless: enumerate the services, turn the exposed weakness into a shell, and escalate to root.