SquareZero

Intercept is a multi-layered, hard-difficulty Windows machine that emphasizes lateral movement, NTLM relay attacks, and advanced certificate abuse techniques. Initial enumeration reveals an SMB share allowing write access, leading to the extraction of autologon credentials and NTLMv2 hashes via Autologon64 and slinky. These credentials are cracked and used to stage a relay attack over HTTP using a WebDAV listener. LDAP signing is disabled, making NTLM relay via ntlmrelayx and dnstool.py possibl ...

Mythical is a medium-difficulty Windows lab that simulates a post-breach assessment within a network hardened after a prior ransomware attack. Initial access is gained through a pre-established Mythic C2 session, allowing enumeration of internal infrastructure via a VPN tunnel. Backup misconfigurations expose sensitive data over rsync, leading to credential recovery from a KeePass database. Active Directory misconfigurations are exploited by escalating an ESC4 certificate template to ESC1, enab ...

PUSH is a multi-staged Windows machine that requires a blend of service enumeration and abuse of enterprise-level misconfigurations. Initial access is achieved via an anonymously accessible FTP server exposing .git contents, from which valid credentials are extracted. These are used to interact with a ClickOnce application hosted on a writable SMB share, allowing us to backdoor a DLL and gain execution as Kelly.Hill. BloodHound analysis reveals WriteAccountRestrictions on MS01, enabling a resou ...

XEN is a medium difficulty machine that starts with a public-facing web service where a directory enumeration reveals a Citrix XenApp installation. After bypassing the XenApp interface, a login portal is found, and a phishing attack is used to gather valid credentials. The SMTP service is also exploited to enumerate users, providing more targets for the attack. Once inside the Citrix portal, an attacker downloads the configuration file and uses a 32-bit Citrix Receiver to gain access. Further, ...

Sendai is a medium difficulty machine that requires thorough enumeration of SMB and LDAP services. Initial access is gained through a null session, revealing a shared file indicating that employees must change their passwords upon login. Using RID brute-forcing, I enumerate domain usernames and identify accounts with the STATUS_PASSWORD_MUST_CHANGE error. Exploiting this, I reset passwords remotely and gain access to a configuration share containing credentials. With valid credentials, I analyz ...

Retro2 presents a easy difficulty challenge, where enumeration reveals several critical services, including LDAP and SMB. After gaining initial access via guest login, I discover a password-protected Microsoft Access .accdb file, which I decrypt using John the Ripper. Credentials retrieved from the file allow further exploitation. Utilizing the credentials, I identify vulnerabilities in the system: Zerologon and NoPac. Zerologon enables me to reset the Domain Controller password without credent ...

Breach is a Medium difficulty lab that simulates a real-world Windows Active Directory environment with layered security mechanisms. The attack begins with extensive enumeration, uncovering SMB shares accessible via guest login. By leveraging a shortcut file attack, the attacker captures NTLMv2 hashes, which are cracked to retrieve credentials. A Kerberoasting attack yields the hash of a service account, leading to Silver Ticket creation for elevated access to the MSSQL server. Privilege escala ...

Tengu is a Hard difficulty lab that focuses on exploiting a complex Windows-based environment, involving multiple stages of lateral movement and privilege escalation. The attack starts by discovering a vulnerable Node-Red instance, leading to remote code execution (RCE) through the exploitation of the exec function. The attacker decrypts MSSQL credentials and sets up an SSH tunnel for pivoting, gaining internal access to the MSSQL server. Active Directory enumeration with BloodHound uncovers ac ...

Kaiju is a Hard difficulty lab focused on exploiting a Windows-based network with multiple stages of lateral movement and privilege escalation. The attack begins with FTP access using default credentials, revealing a FileZilla config file and a KeePass database. After decrypting the FileZilla backup user’s password, SSH access is established, and the attacker manipulates the FileZilla configuration to access the system’s C: drive. From there, the KeePass database is targeted using a custom plug ...

Reflection is a Medium difficulty machine where enumeration and exploitation involve a thorough assessment of a Windows-based network. The user started by identifying open ports and services, leading to the discovery of an SMB share containing database credentials. These credentials were used to access MSSQL servers, where additional credentials were retrieved. By exploiting SMB relay vulnerabilities and using Bloodhound for Active Directory enumeration, the user identified privileges like Gene ...