nitesh@gupta
Offensive Security Proving Grounds

Proving Grounds Linux Writeups

Linux boxes: service and web enumeration, public exploit work, and privilege escalation through SUID binaries, sudo rules, cron jobs and capabilities.

boxes 25CVEs covered 8

Linux boxes

25 boxes
BitForgeLinux

Enumeration across 22/ssh, 80/http, 3306/mysql. Foothold to root using evil-winrm, kerberoasting, linpeas.

22/ssh80/http3306/mysql
CLUELinux

Enumeration across 22/ssh, 80/http, 139/netbios-ssn, 445/netbios-ssn, 3000/http. Foothold to root using evil-winrm, kerberoasting, linpeas.

22/ssh80/http139/netbios-ssn445/netbios-ssn
CockpitLinux

Enumeration across 22/ssh, 80/http, 9090/http. Foothold to root using evil-winrm, kerberoasting, linpeas.

22/ssh80/http9090/http
CodoLinux

Enumeration across 22/ssh, 80/http. Foothold to root using evil-winrm, kerberoasting, linpeas.

22/ssh80/http
CraneLinux

Enumeration across 22/ssh, 80/http, 3306/mysql, 33060/mysqlx. Exploits CVE-2022-23940. Foothold to root using evil-winrm, kerberoasting, linpeas.

22/ssh80/http3306/mysql33060/mysqlxCVE-2022-23940
ExtplorerLinux

Enumeration across 22/ssh, 80/http. Foothold to root using evil-winrm, kerberoasting, linpeas.

22/ssh80/http
FiredLinux

Enumeration across 22/ssh, 9090/hadoop-datanode, 9091/ssl/hadoop-tasktracker. Exploits CVE-2023-32315. Foothold to root using evil-winrm, kerberoasting, linpeas.

22/ssh9090/hadoop-datanode9091/ssl/hadoop-tasktrackerCVE-2023-32315
FluLinux

Enumeration across 22/ssh, 8090/http, 8091/jamlink?. Foothold to root using evil-winrm, kerberoasting, linpeas.

22/ssh8090/http8091/jamlink?
HUBLinux

Enumeration across 22/ssh, 80/http, 8082/http, 9999/ssl/http. Exploits CVE-2024-27697. Foothold to root using evil-winrm, kerberoasting, linpeas.

22/ssh80/http8082/http9999/ssl/httpCVE-2024-27697
ImageLinux

Enumeration across 22/ssh, 80/http. Exploits CVE-2023-34152. Foothold to root using evil-winrm, kerberoasting, linpeas.

22/ssh80/httpCVE-2023-34152
JordakLinux

Foothold to root using evil-winrm, kerberoasting, linpeas.

LavitaLinux

Enumeration across 22/ssh, 80/http. Exploits CVE-2021-3129. Foothold to root using evil-winrm, kerberoasting, linpeas.

22/ssh80/httpCVE-2021-3129
LawLinux

Enumeration across 22/ssh, 80/http. Exploits CVE-2022-35914. Foothold to root using evil-winrm, kerberoasting, linpeas.

22/ssh80/httpCVE-2022-35914
LevramLinux

Enumeration across 22/ssh, 8000/http. Foothold to root using evil-winrm, kerberoasting, linpeas.

22/ssh8000/http
PCLinux

Enumeration across 22/ssh, 8000/http. Exploits CVE-2022-35411. Foothold to root using evil-winrm, kerberoasting, linpeas.

22/ssh8000/httpCVE-2022-35411
PlumLinux

Enumeration across 22/ssh, 80/http. Foothold to root using evil-winrm, kerberoasting, linpeas.

22/ssh80/http
PressLinux

Enumeration across 22/ssh, 80/http, 8089/http. Foothold to root using evil-winrm, kerberoasting, linpeas.

22/ssh80/http8089/http
ProstoreLinux

Enumeration across 22/ssh, 5000/http. Foothold to root using evil-winrm, kerberoasting, linpeas.

22/ssh5000/http
PyLoaderLinux

Enumeration across 22/ssh, 9666/http. Foothold to root using evil-winrm, kerberoasting, linpeas.

22/ssh9666/http
RubyDomeLinux

Enumeration across 22/ssh, 3000/http. Foothold to root using evil-winrm, kerberoasting, linpeas.

22/ssh3000/http
SCRUTINYLinux

Enumeration across 22/ssh, 25/smtp, 80/http. Exploits CVE-2024-27198. Foothold to root using evil-winrm, kerberoasting, ffuf.

22/ssh25/smtp80/httpCVE-2024-27198
SPXLinux

Enumeration across 22/ssh, 80/http. Foothold to root using evil-winrm, kerberoasting, linpeas.

22/ssh80/http
VmdakLinux

Enumeration across 21/ftp, 22/ssh, 80/http, 9443/ssl/http. Foothold to root using evil-winrm, kerberoasting, linpeas.

21/ftp22/ssh80/http9443/ssl/http
WorkaholicLinux

Enumeration across 21/ftp, 22/ssh, 80/http. Foothold to root using evil-winrm, kerberoasting, linpeas.

21/ftp22/ssh80/http
ZipperLinux

Foothold to root using evil-winrm, kerberoasting, linpeas.