Cve

Silentium chains two Flowise CVEs — an unauthenticated password reset token leak and authenticated RCE — with a Gogs symlink exploit to achieve root. A masterclass in chaining modern app vulnerabilities.

DevArea chains a SOAP service SSRF through Hoverfly middleware RCE to foothold, then escalates via Flask session forgery, command injection, and a symlink/log-write trick to root. A deeply layered box with real-world misconfigurations at every turn.

Snapped is a brutal Hard box that chains a pre-auth Nginx UI backup endpoint disclosure into a command injection foothold, then escalates via a race-condition exploit in snap-confine that poisons the dynamic linker to achieve root.

Kobold chains an unauthenticated MCP server command injection with a sneaky newgrp trick that quietly grants Docker group membership — all without a single password prompt.

VariaType is a CVE-chaining masterpiece — three distinct vulnerabilities in font-processing tools combine to take you from unauthenticated to root. If you want practice identifying real-world supply-chain CVEs, this box delivers.

Principal chains a fresh CVE in pac4j-jwt — where encryption was mistaken for authentication — with SSH CA key abuse to go from zero to root on a Java Spring Boot platform.

CCTV is a deceptively layered Easy box where default credentials are just the beginning — JWT forgery, daemon-based command injection, and a clever motionEye auth quirk all stand between you and root.

Eighteen is a Windows Server 2025 Domain Controller box that chains MSSQL impersonation, Werkzeug hash cracking, and the newly-disclosed BadSuccessor vulnerability (CVE-2025-53779) to achieve full domain compromise — a rare chance to exploit a live DC in a lab environment.

Interpreter chains a pre-auth deserialization RCE against a healthcare integration platform with a devious Python f-string injection to reach root — a box that rewards thorough enumeration and creative payload crafting.

Pirate is a brutal Hard-rated Windows Domain Controller that chains together gMSA password extraction, ADFS internals abuse, NTLM relay over a Hyper-V double-pivot, and SPN hijacking to reach Domain Admin — a genuine enterprise attack simulation.