Summary
Standalones — Summary
Compiled from 5 exam reports across 4 distinct exam attempts/practice sets.
| Label | Type | Subnet |
| Exam A | Informal notes | 192.168.132.0/24 |
| Exam B | Informal notes | 192.168.145.0/24 |
| Exam C | Formal report | 192.168.130.0/24 |
| Exam D | Formal report | 192.168.114.0/24 |
| Exam E | Draft (same environment as Exam C) | 192.168.134.0/24 |
Attack Overview
| Target | OS | Initial Foothold | PrivEsc Result |
| .110 (Exam A) | Linux | Anonymous rsync → .env creds → MySQL → bcrypt crack → SSH (sarah) | No PrivEsc achieved |
| .111 (Exam A) | Windows | Guest SMB → Web.config → MSSQL → ServiceAccounts table → WinRM (dom) | No PrivEsc achieved |
| .112 (Exam A) | Windows/IIS | vhost fuzzing → helpdesk portal → unrestricted file upload RCE (.aspx bypass via Burp) | Not documented |
| .112 (Exam B) | Linux | Employee portal self-registration → SSH private key in profile (clara) | linpeas → .mysql_history → MySQL creds → bcrypt crack → lateral to marcus → NOPASSWD sudo → root |
| .111 (Exam B) | Windows | Guest SMB → WebDev share → Web.config MSSQL creds → credential spray | No PrivEsc achieved |
| .110 (Exam C) | Linux | WHOIS enum → Hydra POP3 brute → read mailbox → SSH creds in email (james) | dev group → Nexus config → world-readable log → LFI via Nexus API → root SSH key → root |
| .111 (Exam C) | Windows | Weak Jenkins creds → Groovy script RCE | SeManageVolumePrivilege → DLL hijack → SeImpersonate → SYSTEM |
| .112 (Exam C) | Linux | Employee portal self-registration → SSH private key leak | MySQL creds → bcrypt crack → password reuse → unrestricted sudo → root |
| .110 (Exam D) | Linux | Anonymous rsync → .env DB creds → SSH (sarah) | linpeas → .env creds → MySQL → bcrypt crack (sarah only cracked) |
| .111 (Exam D) | Windows | Anonymous FTP → Sandra creds → Argus DVR path traversal → SMB spray → WinRM (Sandra) | No PrivEsc achieved |
Recurring Themes
- Credential reuse between application accounts and OS/SSH accounts was the most common foothold path
- Plaintext credentials in config files (.env, Web.config, XML connection strings) were present in the majority of machines
- Unauthenticated/anonymous access (rsync, SMB guest, FTP) as the entry point to those config files
- bcrypt hashes appeared consistently — all cracked using
hashcat -m 3200 with rockyou.txt; only weak passwords cracked - linpeas surfaced PrivEsc paths that manual enumeration missed in multiple cases
- NOPASSWD sudo and dev group membership were the two Linux PrivEsc mechanisms when PrivEsc succeeded
- Windows token privilege abuse (SeManageVolumePrivilege) was the standalone Windows PrivEsc pattern
Linked Notes