Git Good
Scrubbed creds that only left the working tree. git log the tooling project, check out the initial commit, and pull the service password from the old config.py to become the next user and grab their flag.
$ Easy
Looking Back
Sloppy operator left a password in shell history. Read ~/.bash_history from the svc-deploy foothold to find creds echoed into chpasswd, su to that user, and read their flag.
Doctor Appointment 1
SQLi auth-bypass in a healthcare login. Send the injection to the API and read the full JSON response - it leaks the username, password and flag.
Brunner Mifflin (Root)
IT terminal creds + sudo NOPASSWD on /usr/bin/mail. GTFOBins payload spawns a root shell for the flag.
Brunner Mifflin (User)
IDOR + broken access control in an HR web app. Manipulate a client-side role in localStorage to unlock admin access and grab the flag.
Line Tap
Fingerprinted a Telnet service running vulnerable GNU InetUtils telnetd, exploited CVE-2026-24061 via USER env injection to bypass auth and grab root shell + flag.
Baby
Anonymous LDAP enumeration exposes domain users. Password spraying identifies a second account. SeBackupPrivilege is abused to extract ntds.dit, leading to a full domain compromise via Pass-the-Hash.
Conversor
An unsanitized XSLT parser allows arbitrary file writes for RCE. Credentials are recovered from a SQLite database. A Perl config injection grants a root shell.
WingData
A null-byte injection CVE-2025-47812. Credentials for a second user are recovered from config files. A symlink and hardlink chaining technique CVE-2025-4517.