Phantom is a Windows machine running Active Directory. Guest authentication over SMB makes it possible to enumerate shares and recover an…

Analysis is a Windows machine running Active Directory. An internal subdomain hosts a webpage vulnerable to LDAP injection, which can be…

Cicada is a Windows machine running Active Directory with an open SMB share that contains a default password. Usernames can be enumerated by…

EscapeTwo is a Windows machine running Active Directory. The box starts with a set of given credentials, which can be used to enumerate SMB…

Administrator is a Windows machine running Active Directory. The box starts with a given set of credentials, which can be used to gather…

Axlle is a Windows machine running Active Directory. A hosted website displays a maintenance notice, but also mentions that outstanding…

Object is a Windows machine running Active Directory. Access to a Jenkins instance allows for triggering builds that execute batch commands…

Monitored is a Linux machine running an instance of Nagios XI. A username and password for Nagios can be discovered from SNMP data, which…

Blurry is a Linux machine running an application with a vulnerable version of ClearML, which contains a deserialization flaw (CVE-2024-2459…

EvilCUPS is a Linux machine affected by several vulnerabilities discovered in CUPS (Common Unix Printing System) in September 2024. These…

Builder is a Linux machine running a version of Jenkins with an arbitrary file read vulnerability via the CLI (CVE-2024-23897). This…

Aero is a Windows machine hosting a website that allows users to upload custom Windows 11 themes. Due to a known RCE vulnerability in…

Visual is a Windows machine hosting a website that compiles Visual Studio projects from a remote Git repository. Command execution on the…

Jab is a Windows machine running Active Directory with an XMPP server that allows open registration. Once an account has been created, a…

Manager is a Windows machine running Active Directory. After gathering a list of domain users by brute-forcing RIDs, one of the users is…

Blackfield is a Windows machine running Active Directory. A list of potential usernames can be created based on user directories found in an…

Reel is a Windows machine running Active Directory with an open FTP server that contains a few documents, one of which reveals an email…

Escape is a Windows machine running Active Directory with an open SMB share containing credentials for an MSSQL instance. After connecting…

Scrambled is a Windows machine running Active Directory. A username can be found on a hosted webpage as well as a message indicating that…

Cascade is a Windows machine running Active Directory. An anonymous LDAP bind allows for enumeration of the environment, leading to the…

Monteverde is a Windows machine with an Active Directory environment featuring Azure AD. After enumerating domain users, it can be…

Resolute is a Windows machine running Active Directory. A few different methods can be used to enumerate users on the system and reveal an…

VulnNet: Active is a Windows machine running Active Directory with an instance of Redis that doesn't require authentication. This can be…

Timelapse is a Windows machine running Active Directory with an open SMB share that contains a password-protected ZIP archive. The password…

Blue is a Windows machine running SMB. A scan with Nmap can reveal that the box is vulnerable to EternalBlue, an exploit that targets a flaw…

Return is a Windows machine running Active Directory. A webpage featuring a printer admin panel can be leveraged to reveal LDAP credentials…

Sauna is a Windows machine featuring an Active Directory environment. A list of potential usernames can be generated based on a webpage that…

Active is a Windows machine running Active Directory with an open SMB share that contains an encrypted GPP (Group Policy Preferences…

Forest is a Windows machine running Active Directory. An anonymous LDAP bind allows for enumeration of the system which can be leveraged to…

Cronos is a Linux machine hosting a website with an admin subdomain that contains a login form with a SQL injection vulnerability. After…

Authority is a Windows machine running Active Directory that has an open SMB share containing ansible vault encrypted credentials. Once…

Topology is a Linux machine hosting a website with a PNG image generator based on LaTeX inline math mode commands. This feature can be…

Inject is a Linux machine hosting a cloud storage and collaboration app built with Java and the Spring framework. A route on the app has a…

MonitorsTwo is a Linux machine with a web application that uses Cacti, a web based monitoring and fault management framework. The version of…

Busqueda is a Linux machine featuring a web application that provides users with a URL for a variety of search engines across the web with…

PC is a Linux machine with an open port running gRPC (Google Remote Procedure Call). Interaction with the server using allows for the…

TwoMillion is a Linux machine hosting a web application with an API that has a command injection vulnerability. This vulnerability can be…

Mirai features a Raspberry Pi device with default credentials that can be used to log in over SSH. Enumeration of the machine reveals a USB…

Diogenes' Rage is a web challenge featuring a vending machine application that enables users to purchase items using a coupon worth $1.0…