A Linux box where the attack surface is the air between three VLANs. A password leaked over SNMP opens a consultant laptop stocked with Wi-Fi radios, and the route to root runs through the networks it can hear: crack the tablets’ WPA2-PSK, decrypt the capture to hijack a cookie-trusting router panel, pivot through a .phtml upload, then clone the corporate WPA2-Enterprise AP with its own stolen certificate to crack an EAP identity and reach root.
A Linux box modelling an industrial plant, where the privilege escalation is not a CVE but the plant’s own safety logic being fed a forged sensor reading. Unauthenticated Apache NiFi → operator SSH key in support-bundles → password-cracked PLC manual → anonymous OPC UA writes → CalibrationOffset ramped into the maintenance window → helix-maint-console → root.
A Windows domain box where a chain of small misconfigurations adds up to full control, ending in an Active Directory certificate template flaw. Henry → targeted Kerberoast on Alfred → AddSelf to INFRASTRUCTURE → ReadGMSAPassword on ansible_dev$ → Sam → John → WinRM pivot → reanimate tombstoned cert_admin via John’s GenericAll on OU=ADCS → ESC15 (CVE-2024-49019) on the WebServer template → Administrator.
Mapping an Active Directory domain with BloodHound, then walking the permission chain it exposes from a low-privilege account to domain administrator. Olivia → BloodHound ACL chain (ForceChangePassword) → Benjamin → FTP .psafe3 → hashcat → password spray to Emily → targetedKerberoast on Ethan → DCSync Administrator.
A Windows box that falls to a known file-server vulnerability, then to a kernel-level privilege escalation. Rejetto HFS 2.3 RCE (CVE-2014-6287) for a foothold, then local exploit enumeration to SYSTEM.
A web app that leaks another user’s traffic capture, and a Linux privilege feature left too permissive. IDOR → PCAP recovery of credentials → SSH user shell → Linux file capabilities (getcap) → root via python3.8 capability.
An exposed backup gives up a reused password, and the box’s own wireless hardware provides the route to root. Anonymous FTP → backup extraction → credential reuse (SSH) → local wireless enumeration → WPS PIN attack (reaver) → root via local escalation.
Exploiting MS17-010 (EternalBlue) on a Windows 7 SP1 target. Recon, SMB enumeration, exploitation, and proof of SYSTEM access.