resux_

Files.

10 machines, each filed under the phase it best demonstrates.

Phase
Surface
Platform
State
FILE 010 · Privilege escalation OPEN

Nexus

A password scrubbed from .env survives in Gitea's commit history, Krayin's email composer stores an attachment the web server will execute, and a root sync timer trusts filenames that come out of a git tree.

  • credential in Gitea commit history
  • Krayin attachment upload
  • password reuse to SSH
  • crafted git tree path traversal
  • SUID bash via /etc/cron.d
FILE 003 · Initial access OPEN

Barrier

A credential in a public repo becomes GitLab admin via a SAML signature-wrapping bug, CI/CD variables hand back the IdP token, and Guacamole stores its backend credentials in cleartext. Root was typed into bash history.

  • leaked repo credential
  • CVE-2024-45409 SAML XSW
  • admin PAT to CI/CD variables
  • authentik set_password
  • Guacamole stored creds
  • bash history password
FILE 004 · Initial access OPEN

CCTV

ZoneMinder 1.37.63 gives up bcrypt hashes to a blind SQLi, and its auth secret was never changed, so I forge a superadmin session instead of cracking. Root is Motion's unauth config API running $(...) as a filename.

  • ZoneMinder default creds
  • CVE-2024-51482 blind SQLi
  • forged legacy auth hash
  • monitor Device injection
  • Motion config injection
FILE 005 · Initial access SEALED

DevHub

Sealed while the box is active. Encrypted, and it stays that way.

  • sealed
FILE 006 · Privilege escalation SEALED

Helix

Sealed while the box is active. Encrypted, and it stays that way.

  • sealed
FILE 007 · Lateral / AD OPEN

Overwatch

A guest-readable SMB share hands over a .NET binary with SQL credentials in it, a stale linked server plus a DNS record I add myself relays auth to me, and a WCF service concatenates its input into PowerShell as SYSTEM.

  • .NET decompile
  • hardcoded SQL creds
  • linked server DNS poisoning
  • NTLM capture
  • WCF command injection
FILE 008 · Initial access SEALED

SmartHire

Sealed while the box is active. Encrypted, and it stays that way.

  • sealed
FILE 009 · Privilege escalation OPEN

WingData

NULL byte in Wing FTP's login username writes Lua into the session file for RCE, a salted SHA-256 from its own config cracks to wacky, then a PATH_MAX bug in Python's tarfile data filter writes root's authorized_keys.

  • CVE-2025-47812
  • Lua session injection
  • salted SHA-256 crack
  • CVE-2025-4517 tarfile escape
FILE 002 · Initial access SEALED

MakeSense

Sealed while the box is active. Encrypted, and it stays that way.

  • sealed
FILE 001 · Privilege escalation OPEN

Interpreter

Mirth Connect 4.4.0 (CVE-2023-43208) for the foothold, DB creds and channel analysis to an internal root-owned service, then Python eval() injection in HL7-derived XML to read both flags.

  • CVE-2023-43208
  • DB creds
  • internal HL7 service
  • eval() injection