Proving Grounds Windows
17 boxesWindows boxes: SMB and web enumeration, public exploits, token and service abuse, and privilege escalation to SYSTEM.
Enumeration across 21/ftp, 80/http, 135/msrpc, 139/netbios-ssn, 445/microsoft-ds?. Foothold to root using evil-winrm, kerberoasting, winpeas.
Enumeration across 21/ftp, 242/http, 3145/zftp-admin, 3389/ms-wbt-server. Foothold to root using evil-winrm, kerberoasting, winpeas.
Enumeration across 80/http. Foothold to root using evil-winrm, kerberoasting, winpeas.
Enumeration across 22/ssh, 135/msrpc, 139/netbios-ssn, 445/microsoft-ds?, 8080/http-proxy. Foothold to root using evil-winrm, kerberoasting, winpeas.
Enumeration across 25/smtp, 79/finger, 105/ph-addressbook, 106/pop3pw, 110/pop3. Foothold to root using evil-winrm, kerberoasting, winpeas.
Enumeration across 53/domain, 80/http, 88/kerberos-sec, 135/msrpc, 139/netbios-ssn. Foothold to root using evil-winrm, kerberoasting, winpeas.
Enumeration across 53/domain, 135/msrpc, 139/netbios-ssn, 445/microsoft-ds, 3389/ms-wbt-server. Foothold to root using evil-winrm, kerberoasting, winpeas.
Enumeration across 80/http, 135/msrpc, 139/netbios-ssn, 445/microsoft-ds?, 8082/http. Foothold to root using evil-winrm, kerberoasting, winpeas.
Enumeration across 80/http, 135/msrpc, 139/netbios-ssn, 445/microsoft-ds, 3389/ms-wbt-server. Foothold to root using evil-winrm, kerberoasting, winpeas.
Enumeration across 135/msrpc, 139/netbios-ssn, 445/microsoft-ds?, 5040/unknown, 8000/http-alt. Foothold to root using evil-winrm, kerberoasting, winpeas.
Enumeration across 1978/remotemouse, 1980/pearldoc-xact?, 7680/pando-pub?. Foothold to root using evil-winrm, kerberoasting, winpeas.
Enumeration across 80/http, 135/msrpc, 139/netbios-ssn, 443/ssl/http, 445/microsoft-ds?. Foothold to root using evil-winrm, kerberoasting, winpeas.
Enumeration across 21/ftp, 22/ssh, 80/tcpwrapped, 139/netbios-ssn, 445/microsoft-ds?. Foothold to root using evil-winrm, kerberoasting, winpeas.
Enumeration across 53/domain, 88/kerberos-sec, 135/msrpc, 139/netbios-ssn, 389/ldap. Foothold to root using evil-winrm, impacket, secretsdump.
Enumeration across 21/ftp, 80/http, 135/msrpc, 139/netbios-ssn, 443/ssl/http. Exploits CVE-2015-4133. Foothold to root using evil-winrm, kerberoasting, winpeas.
Enumeration across 21/ftp, 135/msrpc, 139/netbios-ssn, 445/microsoft-ds?, 4443/http. Foothold to root using evil-winrm, kerberoasting, winpeas.
Enumeration across 135/msrpc, 139/netbios-ssn, 445/microsoft-ds?, 49666/msrpc, 49667/msrpc. Foothold to root using evil-winrm, kerberoasting, winpeas.
Proving Grounds Linux
25 boxesLinux boxes: service and web enumeration, public exploit work, and privilege escalation through SUID binaries, sudo rules, cron jobs and capabilities.
Enumeration across 22/ssh, 80/http, 3306/mysql. Foothold to root using evil-winrm, kerberoasting, linpeas.
Enumeration across 22/ssh, 80/http, 139/netbios-ssn, 445/netbios-ssn, 3000/http. Foothold to root using evil-winrm, kerberoasting, linpeas.
Enumeration across 22/ssh, 80/http, 9090/http. Foothold to root using evil-winrm, kerberoasting, linpeas.
Enumeration across 22/ssh, 80/http. Foothold to root using evil-winrm, kerberoasting, linpeas.
Enumeration across 22/ssh, 80/http, 3306/mysql, 33060/mysqlx. Exploits CVE-2022-23940. Foothold to root using evil-winrm, kerberoasting, linpeas.
Enumeration across 22/ssh, 80/http. Foothold to root using evil-winrm, kerberoasting, linpeas.
Enumeration across 22/ssh, 9090/hadoop-datanode, 9091/ssl/hadoop-tasktracker. Exploits CVE-2023-32315. Foothold to root using evil-winrm, kerberoasting, linpeas.
Enumeration across 22/ssh, 8090/http, 8091/jamlink?. Foothold to root using evil-winrm, kerberoasting, linpeas.
Enumeration across 22/ssh, 80/http, 8082/http, 9999/ssl/http. Exploits CVE-2024-27697. Foothold to root using evil-winrm, kerberoasting, linpeas.
Enumeration across 22/ssh, 80/http. Exploits CVE-2023-34152. Foothold to root using evil-winrm, kerberoasting, linpeas.
Foothold to root using evil-winrm, kerberoasting, linpeas.
Enumeration across 22/ssh, 80/http. Exploits CVE-2021-3129. Foothold to root using evil-winrm, kerberoasting, linpeas.
Enumeration across 22/ssh, 80/http. Exploits CVE-2022-35914. Foothold to root using evil-winrm, kerberoasting, linpeas.
Enumeration across 22/ssh, 8000/http. Foothold to root using evil-winrm, kerberoasting, linpeas.
Enumeration across 22/ssh, 8000/http. Exploits CVE-2022-35411. Foothold to root using evil-winrm, kerberoasting, linpeas.
Enumeration across 22/ssh, 80/http. Foothold to root using evil-winrm, kerberoasting, linpeas.
Enumeration across 22/ssh, 80/http, 8089/http. Foothold to root using evil-winrm, kerberoasting, linpeas.
Enumeration across 22/ssh, 5000/http. Foothold to root using evil-winrm, kerberoasting, linpeas.
Enumeration across 22/ssh, 9666/http. Foothold to root using evil-winrm, kerberoasting, linpeas.
Enumeration across 22/ssh, 3000/http. Foothold to root using evil-winrm, kerberoasting, linpeas.
Enumeration across 22/ssh, 25/smtp, 80/http. Exploits CVE-2024-27198. Foothold to root using evil-winrm, kerberoasting, ffuf.
Enumeration across 22/ssh, 80/http. Foothold to root using evil-winrm, kerberoasting, linpeas.
Enumeration across 21/ftp, 22/ssh, 80/http, 9443/ssl/http. Foothold to root using evil-winrm, kerberoasting, linpeas.
Enumeration across 21/ftp, 22/ssh, 80/http. Foothold to root using evil-winrm, kerberoasting, linpeas.
Foothold to root using evil-winrm, kerberoasting, linpeas.
Proving Grounds Active Directory
5 boxesActive Directory attack paths: Kerberoasting and AS-REP roasting, ACL abuse, ADCS misconfiguration, credential relaying and domain escalation.
Enumeration across 53/domain, 80/http, 88/kerberos-sec, 135/msrpc, 139/netbios-ssn. Foothold to root using evil-winrm, kerberoasting, linpeas.
Enumeration across 53/domain, 135/msrpc, 139/netbios-ssn, 389/ldap, 445/microsoft-ds?. Foothold to root using evil-winrm, kerberoasting, linpeas.
Enumeration across 53/domain, 80/http, 88/kerberos-sec, 135/msrpc, 139/netbios-ssn. Foothold to root using evil-winrm, kerberoasting, linpeas.
Enumeration across 53/domain, 80/http, 88/kerberos-sec, 135/msrpc, 139/netbios-ssn. Foothold to root using evil-winrm, kerberoasting, linpeas.
Enumeration across 53/domain, 88/kerberos-sec, 135/msrpc, 139/netbios-ssn, 389/ldap. Foothold to root using evil-winrm, kerberoasting, linpeas.