https://www.niteshgupta.com/writeups/ Offensive Security Proving Grounds walkthroughs by Nitesh Gupta. Enumeration, exploitation and privilege escalation, step by step. en connect@niteshgupta.com (Nitesh Gupta) connect@niteshgupta.com (Nitesh Gupta) Thu, 15 Jan 2026 09:00:00 +0000 build/feed.py https://www.niteshgupta.com/writeups/proving-grounds/linux/zipper/ https://www.niteshgupta.com/writeups/proving-grounds/linux/zipper/ Thu, 15 Jan 2026 09:00:00 +0000 Linux Full walkthrough of the Zipper box on Offensive Security Proving Grounds (Linux). Foothold to root using evil-winrm, kerberoasting, linpeas. https://www.niteshgupta.com/writeups/proving-grounds/linux/workaholic/ https://www.niteshgupta.com/writeups/proving-grounds/linux/workaholic/ Thu, 15 Jan 2026 09:00:00 +0000 Linux Full walkthrough of the Workaholic box on Offensive Security Proving Grounds (Linux). Enumeration across 21/ftp, 22/ssh, 80/http. Foothold to root using evil-winrm, kerberoasting, linpeas. https://www.niteshgupta.com/writeups/proving-grounds/linux/vmdak/ https://www.niteshgupta.com/writeups/proving-grounds/linux/vmdak/ Thu, 15 Jan 2026 09:00:00 +0000 Linux Full walkthrough of the Vmdak box on Offensive Security Proving Grounds (Linux). Enumeration across 21/ftp, 22/ssh, 80/http, 9443/ssl/http. Foothold to root using evil-winrm, kerberoasting, linpeas. https://www.niteshgupta.com/writeups/proving-grounds/ad/vault/ https://www.niteshgupta.com/writeups/proving-grounds/ad/vault/ Thu, 15 Jan 2026 09:00:00 +0000 Active Directory Full walkthrough of the Vault box on Offensive Security Proving Grounds (Active Directory). Enumeration across 53/domain, 88/kerberos-sec, 135/msrpc, 139/netbios-ssn, 389/ldap. Foothold to root using evil-winrm, kerberoasting, linpeas. https://www.niteshgupta.com/writeups/proving-grounds/windows/squid/ https://www.niteshgupta.com/writeups/proving-grounds/windows/squid/ Thu, 15 Jan 2026 09:00:00 +0000 Windows Full walkthrough of the Squid box on Offensive Security Proving Grounds (Windows). Enumeration across 135/msrpc, 139/netbios-ssn, 445/microsoft-ds?, 49666/msrpc, 49667/msrpc. Foothold to root using evil-winrm, kerberoasting, winpeas. https://www.niteshgupta.com/writeups/proving-grounds/windows/slort/ https://www.niteshgupta.com/writeups/proving-grounds/windows/slort/ Thu, 15 Jan 2026 09:00:00 +0000 Windows Full walkthrough of the Slort box on Offensive Security Proving Grounds (Windows). Enumeration across 21/ftp, 135/msrpc, 139/netbios-ssn, 445/microsoft-ds?, 4443/http. Foothold to root using evil-winrm, kerberoasting, winpeas. https://www.niteshgupta.com/writeups/proving-grounds/windows/shenzi/ https://www.niteshgupta.com/writeups/proving-grounds/windows/shenzi/ Thu, 15 Jan 2026 09:00:00 +0000 Windows Full walkthrough of the Shenzi box on Offensive Security Proving Grounds (Windows). Enumeration across 21/ftp, 80/http, 135/msrpc, 139/netbios-ssn, 443/ssl/http. Exploits CVE-2015-4133. Foothold to root using evil-winrm, kerberoasting, winpeas. https://www.niteshgupta.com/writeups/proving-grounds/linux/spx/ https://www.niteshgupta.com/writeups/proving-grounds/linux/spx/ Thu, 15 Jan 2026 09:00:00 +0000 Linux Full walkthrough of the SPX box on Offensive Security Proving Grounds (Linux). Enumeration across 22/ssh, 80/http. Foothold to root using evil-winrm, kerberoasting, linpeas. https://www.niteshgupta.com/writeups/proving-grounds/linux/scrutiny/ https://www.niteshgupta.com/writeups/proving-grounds/linux/scrutiny/ Thu, 15 Jan 2026 09:00:00 +0000 Linux Full walkthrough of the SCRUTINY box on Offensive Security Proving Grounds (Linux). Enumeration across 22/ssh, 25/smtp, 80/http. Exploits CVE-2024-27198. Foothold to root using evil-winrm, kerberoasting, ffuf. https://www.niteshgupta.com/writeups/proving-grounds/linux/ruby-dome/ https://www.niteshgupta.com/writeups/proving-grounds/linux/ruby-dome/ Thu, 15 Jan 2026 09:00:00 +0000 Linux Full walkthrough of the RubyDome box on Offensive Security Proving Grounds (Linux). Enumeration across 22/ssh, 3000/http. Foothold to root using evil-winrm, kerberoasting, linpeas. https://www.niteshgupta.com/writeups/proving-grounds/windows/resourced/ https://www.niteshgupta.com/writeups/proving-grounds/windows/resourced/ Thu, 15 Jan 2026 09:00:00 +0000 Windows Full walkthrough of the Resourced box on Offensive Security Proving Grounds (Windows). Enumeration across 53/domain, 88/kerberos-sec, 135/msrpc, 139/netbios-ssn, 389/ldap. Foothold to root using evil-winrm, impacket, secretsdump. https://www.niteshgupta.com/writeups/proving-grounds/linux/py-loader/ https://www.niteshgupta.com/writeups/proving-grounds/linux/py-loader/ Thu, 15 Jan 2026 09:00:00 +0000 Linux Full walkthrough of the PyLoader box on Offensive Security Proving Grounds (Linux). Enumeration across 22/ssh, 9666/http. Foothold to root using evil-winrm, kerberoasting, linpeas. https://www.niteshgupta.com/writeups/proving-grounds/linux/prostore/ https://www.niteshgupta.com/writeups/proving-grounds/linux/prostore/ Thu, 15 Jan 2026 09:00:00 +0000 Linux Full walkthrough of the Prostore box on Offensive Security Proving Grounds (Linux). Enumeration across 22/ssh, 5000/http. Foothold to root using evil-winrm, kerberoasting, linpeas. https://www.niteshgupta.com/writeups/proving-grounds/linux/press/ https://www.niteshgupta.com/writeups/proving-grounds/linux/press/ Thu, 15 Jan 2026 09:00:00 +0000 Linux Full walkthrough of the Press box on Offensive Security Proving Grounds (Linux). Enumeration across 22/ssh, 80/http, 8089/http. Foothold to root using evil-winrm, kerberoasting, linpeas. https://www.niteshgupta.com/writeups/proving-grounds/linux/plum/ https://www.niteshgupta.com/writeups/proving-grounds/linux/plum/ Thu, 15 Jan 2026 09:00:00 +0000 Linux Full walkthrough of the Plum box on Offensive Security Proving Grounds (Linux). Enumeration across 22/ssh, 80/http. Foothold to root using evil-winrm, kerberoasting, linpeas. https://www.niteshgupta.com/writeups/proving-grounds/linux/pc/ https://www.niteshgupta.com/writeups/proving-grounds/linux/pc/ Thu, 15 Jan 2026 09:00:00 +0000 Linux Full walkthrough of the PC box on Offensive Security Proving Grounds (Linux). Enumeration across 22/ssh, 8000/http. Exploits CVE-2022-35411. Foothold to root using evil-winrm, kerberoasting, linpeas. https://www.niteshgupta.com/writeups/proving-grounds/windows/nickel/ https://www.niteshgupta.com/writeups/proving-grounds/windows/nickel/ Thu, 15 Jan 2026 09:00:00 +0000 Windows Full walkthrough of the Nickel box on Offensive Security Proving Grounds (Windows). Enumeration across 21/ftp, 22/ssh, 80/tcpwrapped, 139/netbios-ssn, 445/microsoft-ds?. Foothold to root using evil-winrm, kerberoasting, winpeas. https://www.niteshgupta.com/writeups/proving-grounds/ad/nagoya/ https://www.niteshgupta.com/writeups/proving-grounds/ad/nagoya/ Thu, 15 Jan 2026 09:00:00 +0000 Active Directory Full walkthrough of the Nagoya box on Offensive Security Proving Grounds (Active Directory). Enumeration across 53/domain, 80/http, 88/kerberos-sec, 135/msrpc, 139/netbios-ssn. Foothold to root using evil-winrm, kerberoasting, linpeas. https://www.niteshgupta.com/writeups/proving-grounds/windows/monster/ https://www.niteshgupta.com/writeups/proving-grounds/windows/monster/ Thu, 15 Jan 2026 09:00:00 +0000 Windows Full walkthrough of the Monster box on Offensive Security Proving Grounds (Windows). Enumeration across 80/http, 135/msrpc, 139/netbios-ssn, 443/ssl/http, 445/microsoft-ds?. Foothold to root using evil-winrm, kerberoasting, winpeas. https://www.niteshgupta.com/writeups/proving-grounds/windows/mice/ https://www.niteshgupta.com/writeups/proving-grounds/windows/mice/ Thu, 15 Jan 2026 09:00:00 +0000 Windows Full walkthrough of the Mice box on Offensive Security Proving Grounds (Windows). Enumeration across 1978/remotemouse, 1980/pearldoc-xact?, 7680/pando-pub?. Foothold to root using evil-winrm, kerberoasting, winpeas. https://www.niteshgupta.com/writeups/proving-grounds/windows/medjed/ https://www.niteshgupta.com/writeups/proving-grounds/windows/medjed/ Thu, 15 Jan 2026 09:00:00 +0000 Windows Full walkthrough of the Medjed box on Offensive Security Proving Grounds (Windows). Enumeration across 135/msrpc, 139/netbios-ssn, 445/microsoft-ds?, 5040/unknown, 8000/http-alt. Foothold to root using evil-winrm, kerberoasting, winpeas. https://www.niteshgupta.com/writeups/proving-grounds/linux/levram/ https://www.niteshgupta.com/writeups/proving-grounds/linux/levram/ Thu, 15 Jan 2026 09:00:00 +0000 Linux Full walkthrough of the Levram box on Offensive Security Proving Grounds (Linux). Enumeration across 22/ssh, 8000/http. Foothold to root using evil-winrm, kerberoasting, linpeas. https://www.niteshgupta.com/writeups/proving-grounds/linux/law/ https://www.niteshgupta.com/writeups/proving-grounds/linux/law/ Thu, 15 Jan 2026 09:00:00 +0000 Linux Full walkthrough of the Law box on Offensive Security Proving Grounds (Linux). Enumeration across 22/ssh, 80/http. Exploits CVE-2022-35914. Foothold to root using evil-winrm, kerberoasting, linpeas. https://www.niteshgupta.com/writeups/proving-grounds/linux/lavita/ https://www.niteshgupta.com/writeups/proving-grounds/linux/lavita/ Thu, 15 Jan 2026 09:00:00 +0000 Linux Full walkthrough of the Lavita box on Offensive Security Proving Grounds (Linux). Enumeration across 22/ssh, 80/http. Exploits CVE-2021-3129. Foothold to root using evil-winrm, kerberoasting, linpeas. https://www.niteshgupta.com/writeups/proving-grounds/windows/kevin/ https://www.niteshgupta.com/writeups/proving-grounds/windows/kevin/ Thu, 15 Jan 2026 09:00:00 +0000 Windows Full walkthrough of the Kevin box on Offensive Security Proving Grounds (Windows). Enumeration across 80/http, 135/msrpc, 139/netbios-ssn, 445/microsoft-ds, 3389/ms-wbt-server. Foothold to root using evil-winrm, kerberoasting, winpeas. https://www.niteshgupta.com/writeups/proving-grounds/linux/jordak/ https://www.niteshgupta.com/writeups/proving-grounds/linux/jordak/ Thu, 15 Jan 2026 09:00:00 +0000 Linux Full walkthrough of the Jordak box on Offensive Security Proving Grounds (Linux). Foothold to root using evil-winrm, kerberoasting, linpeas. https://www.niteshgupta.com/writeups/proving-grounds/windows/jacko/ https://www.niteshgupta.com/writeups/proving-grounds/windows/jacko/ Thu, 15 Jan 2026 09:00:00 +0000 Windows Full walkthrough of the Jacko box on Offensive Security Proving Grounds (Windows). Enumeration across 80/http, 135/msrpc, 139/netbios-ssn, 445/microsoft-ds?, 8082/http. Foothold to root using evil-winrm, kerberoasting, winpeas. https://www.niteshgupta.com/writeups/proving-grounds/windows/internal/ https://www.niteshgupta.com/writeups/proving-grounds/windows/internal/ Thu, 15 Jan 2026 09:00:00 +0000 Windows Full walkthrough of the Internal box on Offensive Security Proving Grounds (Windows). Enumeration across 53/domain, 135/msrpc, 139/netbios-ssn, 445/microsoft-ds, 3389/ms-wbt-server. Foothold to root using evil-winrm, kerberoasting, winpeas. https://www.niteshgupta.com/writeups/proving-grounds/linux/image/ https://www.niteshgupta.com/writeups/proving-grounds/linux/image/ Thu, 15 Jan 2026 09:00:00 +0000 Linux Full walkthrough of the Image box on Offensive Security Proving Grounds (Linux). Enumeration across 22/ssh, 80/http. Exploits CVE-2023-34152. Foothold to root using evil-winrm, kerberoasting, linpeas. https://www.niteshgupta.com/writeups/proving-grounds/ad/hokkaido/ https://www.niteshgupta.com/writeups/proving-grounds/ad/hokkaido/ Thu, 15 Jan 2026 09:00:00 +0000 Active Directory Full walkthrough of the Hokkaido box on Offensive Security Proving Grounds (Active Directory). Enumeration across 53/domain, 80/http, 88/kerberos-sec, 135/msrpc, 139/netbios-ssn. Foothold to root using evil-winrm, kerberoasting, linpeas. https://www.niteshgupta.com/writeups/proving-grounds/windows/hepet/ https://www.niteshgupta.com/writeups/proving-grounds/windows/hepet/ Thu, 15 Jan 2026 09:00:00 +0000 Windows Full walkthrough of the Hepet box on Offensive Security Proving Grounds (Windows). Enumeration across 25/smtp, 79/finger, 105/ph-addressbook, 106/pop3pw, 110/pop3. Foothold to root using evil-winrm, kerberoasting, winpeas. https://www.niteshgupta.com/writeups/proving-grounds/ad/heist/ https://www.niteshgupta.com/writeups/proving-grounds/ad/heist/ Thu, 15 Jan 2026 09:00:00 +0000 Active Directory Full walkthrough of the Heist box on Offensive Security Proving Grounds (Active Directory). Enumeration across 53/domain, 135/msrpc, 139/netbios-ssn, 389/ldap, 445/microsoft-ds?. Foothold to root using evil-winrm, kerberoasting, linpeas. https://www.niteshgupta.com/writeups/proving-grounds/windows/hutch/ https://www.niteshgupta.com/writeups/proving-grounds/windows/hutch/ Thu, 15 Jan 2026 09:00:00 +0000 Windows Full walkthrough of the HUTCH box on Offensive Security Proving Grounds (Windows). Enumeration across 53/domain, 80/http, 88/kerberos-sec, 135/msrpc, 139/netbios-ssn. Foothold to root using evil-winrm, kerberoasting, winpeas. https://www.niteshgupta.com/writeups/proving-grounds/linux/hub/ https://www.niteshgupta.com/writeups/proving-grounds/linux/hub/ Thu, 15 Jan 2026 09:00:00 +0000 Linux Full walkthrough of the HUB box on Offensive Security Proving Grounds (Linux). Enumeration across 22/ssh, 80/http, 8082/http, 9999/ssl/http. Exploits CVE-2024-27697. Foothold to root using evil-winrm, kerberoasting, linpeas. https://www.niteshgupta.com/writeups/proving-grounds/linux/flu/ https://www.niteshgupta.com/writeups/proving-grounds/linux/flu/ Thu, 15 Jan 2026 09:00:00 +0000 Linux Full walkthrough of the Flu box on Offensive Security Proving Grounds (Linux). Enumeration across 22/ssh, 8090/http, 8091/jamlink?. Foothold to root using evil-winrm, kerberoasting, linpeas. https://www.niteshgupta.com/writeups/proving-grounds/linux/fired/ https://www.niteshgupta.com/writeups/proving-grounds/linux/fired/ Thu, 15 Jan 2026 09:00:00 +0000 Linux Full walkthrough of the Fired box on Offensive Security Proving Grounds (Linux). Enumeration across 22/ssh, 9090/hadoop-datanode, 9091/ssl/hadoop-tasktracker. Exploits CVE-2023-32315. Foothold to root using evil-winrm, kerberoasting, linpeas. https://www.niteshgupta.com/writeups/proving-grounds/linux/extplorer/ https://www.niteshgupta.com/writeups/proving-grounds/linux/extplorer/ Thu, 15 Jan 2026 09:00:00 +0000 Linux Full walkthrough of the Extplorer box on Offensive Security Proving Grounds (Linux). Enumeration across 22/ssh, 80/http. Foothold to root using evil-winrm, kerberoasting, linpeas. https://www.niteshgupta.com/writeups/proving-grounds/windows/dvr4/ https://www.niteshgupta.com/writeups/proving-grounds/windows/dvr4/ Thu, 15 Jan 2026 09:00:00 +0000 Windows Full walkthrough of the DVR4 box on Offensive Security Proving Grounds (Windows). Enumeration across 22/ssh, 135/msrpc, 139/netbios-ssn, 445/microsoft-ds?, 8080/http-proxy. Foothold to root using evil-winrm, kerberoasting, winpeas. https://www.niteshgupta.com/writeups/proving-grounds/linux/crane/ https://www.niteshgupta.com/writeups/proving-grounds/linux/crane/ Thu, 15 Jan 2026 09:00:00 +0000 Linux Full walkthrough of the Crane box on Offensive Security Proving Grounds (Linux). Enumeration across 22/ssh, 80/http, 3306/mysql, 33060/mysqlx. Exploits CVE-2022-23940. Foothold to root using evil-winrm, kerberoasting, linpeas. https://www.niteshgupta.com/writeups/proving-grounds/windows/craft/ https://www.niteshgupta.com/writeups/proving-grounds/windows/craft/ Thu, 15 Jan 2026 09:00:00 +0000 Windows Full walkthrough of the Craft box on Offensive Security Proving Grounds (Windows). Enumeration across 80/http. Foothold to root using evil-winrm, kerberoasting, winpeas. https://www.niteshgupta.com/writeups/proving-grounds/linux/codo/ https://www.niteshgupta.com/writeups/proving-grounds/linux/codo/ Thu, 15 Jan 2026 09:00:00 +0000 Linux Full walkthrough of the Codo box on Offensive Security Proving Grounds (Linux). Enumeration across 22/ssh, 80/http. Foothold to root using evil-winrm, kerberoasting, linpeas. https://www.niteshgupta.com/writeups/proving-grounds/linux/cockpit/ https://www.niteshgupta.com/writeups/proving-grounds/linux/cockpit/ Thu, 15 Jan 2026 09:00:00 +0000 Linux Full walkthrough of the Cockpit box on Offensive Security Proving Grounds (Linux). Enumeration across 22/ssh, 80/http, 9090/http. Foothold to root using evil-winrm, kerberoasting, linpeas. https://www.niteshgupta.com/writeups/proving-grounds/linux/clue/ https://www.niteshgupta.com/writeups/proving-grounds/linux/clue/ Thu, 15 Jan 2026 09:00:00 +0000 Linux Full walkthrough of the CLUE box on Offensive Security Proving Grounds (Linux). Enumeration across 22/ssh, 80/http, 139/netbios-ssn, 445/netbios-ssn, 3000/http. Foothold to root using evil-winrm, kerberoasting, linpeas. https://www.niteshgupta.com/writeups/proving-grounds/linux/bit-forge/ https://www.niteshgupta.com/writeups/proving-grounds/linux/bit-forge/ Thu, 15 Jan 2026 09:00:00 +0000 Linux Full walkthrough of the BitForge box on Offensive Security Proving Grounds (Linux). Enumeration across 22/ssh, 80/http, 3306/mysql. Foothold to root using evil-winrm, kerberoasting, linpeas. https://www.niteshgupta.com/writeups/proving-grounds/windows/authby/ https://www.niteshgupta.com/writeups/proving-grounds/windows/authby/ Thu, 15 Jan 2026 09:00:00 +0000 Windows Full walkthrough of the Authby box on Offensive Security Proving Grounds (Windows). Enumeration across 21/ftp, 242/http, 3145/zftp-admin, 3389/ms-wbt-server. Foothold to root using evil-winrm, kerberoasting, winpeas. https://www.niteshgupta.com/writeups/proving-grounds/windows/algernon/ https://www.niteshgupta.com/writeups/proving-grounds/windows/algernon/ Thu, 15 Jan 2026 09:00:00 +0000 Windows Full walkthrough of the Algernon box on Offensive Security Proving Grounds (Windows). Enumeration across 21/ftp, 80/http, 135/msrpc, 139/netbios-ssn, 445/microsoft-ds?. Foothold to root using evil-winrm, kerberoasting, winpeas. https://www.niteshgupta.com/writeups/proving-grounds/ad/access/ https://www.niteshgupta.com/writeups/proving-grounds/ad/access/ Thu, 15 Jan 2026 09:00:00 +0000 Active Directory Full walkthrough of the Access box on Offensive Security Proving Grounds (Active Directory). Enumeration across 53/domain, 80/http, 88/kerberos-sec, 135/msrpc, 139/netbios-ssn. Foothold to root using evil-winrm, kerberoasting, linpeas.