https://wearethebug.dev/tags/easy/Recent content on WE ARE THE BUGTradecraften-usSun, 04 Oct 2026 00:00:00 +0000https://wearethebug.dev/posts/htb-touch/Sun, 04 Oct 2026 00:00:00 +0000https://wearethebug.dev/posts/htb-touch/Touch is an Easy-rated Windows machine featuring a kiosk-mode device management application. Initial access stems from improperly secured credentials exposed through the device's API, leading to a restricted user session that requires creative exploitation to break out of its locked-down environment and reach a full shell. Privilege escalation involves abusing misconfigured service permissions and exposed database credentials to escalate to full administrative control.https://wearethebug.dev/posts/htb-reactor/Sun, 24 May 2026 00:00:00 +0000https://wearethebug.dev/posts/htb-reactor/Reactor is an Easy-rated Linux machine where initial access is gained by exploiting CVE-2025-55182 (React2Shell), a pre-auth RCE in React Server Components triggered via a crafted Next-Action header, yielding a shell as node. Credentials are extracted from a SQLite database dump, cracked to reveal valid SSH access for lateral movement to the user engineer. Privilege escalation abuses an exposed Node.js debug port (9229), reached via SSH tunnel, to call process.mainModule.require and execute commands as root.https://wearethebug.dev/posts/vl-share/Wed, 08 Jan 2025 00:00:00 +0000https://wearethebug.dev/posts/vl-share/Share is an easy crypto challenge where the flag is encoded in a polynomial function f(x) = flag + a₁x + a₂x² + a₃x³, with 10 known points (x, f(x)) provided.https://wearethebug.dev/posts/vl-warmup1/Wed, 08 Jan 2025 00:00:00 +0000https://wearethebug.dev/posts/vl-warmup1/Warmup 1 is a easy misc challenge focus on Discord bot commands.https://wearethebug.dev/posts/vl-warmup2/Wed, 08 Jan 2025 00:00:00 +0000https://wearethebug.dev/posts/vl-warmup2/Warmup 2 is a easy misc challenge where the flag is hidden in a provided file.https://wearethebug.dev/posts/vl-warmup3/Wed, 08 Jan 2025 00:00:00 +0000https://wearethebug.dev/posts/vl-warmup3/Warmup 3 is a easy misc challenge where the flag is hidden on a webpage.https://wearethebug.dev/posts/vl-baby/Sat, 28 Sep 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-baby/Baby is an easy difficulty Windows machine that features LDAP enumeration, password spraying and exposed credentials. For privilege escalation, the SeBackupPrivilege is exploited to extract registry hives and the NTDS.dit file. A Pass-the-Hash attack can be performed using the uncovered domain hashes ultimately achieving Administrator access.https://wearethebug.dev/posts/vl-down/Fri, 20 Sep 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-down/Down is an easy-rated Linux machine that involves exploiting an arbitrary file read by bypassing a protocol-based filter to discover the source code of the running PHP web app, eventually, a remote code execution to gain an initial foothold. The attacker finds a readable pswm encrypted file in the user's home directory. The pwsm uses Python's cryptocode module and a master password to encrypt and decrypt the data. The attacker is supposed to write a small script to decrypt the blob and compromise the user. The compromised user is a member of the sudo group, allowing the user to escalate and obtain root access.https://wearethebug.dev/posts/vl-ifrit/Sun, 15 Sep 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-ifrit/Ifrit is an Assumed-Breach scenario with the main objective is getting domain administrator privileges in the ifrit.vl Domain. It designed for those with foundational AD and pentesting knowledge to hone covert red teaming skills. Players aim for Domain Admin while evading real-time detections, practicing AD enumeration, exploitation, certificate services, lateral movement, EDR bypass, and relay attacks across multiple forests.https://wearethebug.dev/posts/vl-retro2/Thu, 22 Aug 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-retro2/Retro2 is an easy difficulty Windows machine, which highlights AD exploitation. Initial external enumeration reveals a publicly accessible SMB Share containing a Microsoft Access Database file, which is password protected. After cracking the password, the contents of the accdb file are accessible, enabling the retrieval of the VBA script inside, where AD credentials can be retrieved. Then, by abusing pre-created computer accounts , we gain access to a computer account with the GenericWrite privilege over another account, which, when leveraged, provides access to the system via RDP . Finally, exploiting the RpcEptMapper registry key results in privilege escalation to a system account.https://wearethebug.dev/posts/vl-manage/Fri, 28 Jun 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-manage/Manage is an easy Linux machine that features an exposed Java RMI service. Exploiting the underlying vulnerable JMX service leads to remote code execution and gaining a remote shell as the tomcat user. Lateral movement to the useradmin account can be achieved by discovering a misconfigured backup archive which leaks sensitive files, including SSH keys and OTP codes. Finally, a sudo misconfiguration allows for creating a privileged user and achieving full privilege escalation.https://wearethebug.dev/posts/vl-build/Fri, 10 May 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-build/Build is an easy-level Linux machine hosted on the VulnLab platform. Its attack path relies primarily on exploiting a PowerDNSAdmin database, a configuration leak, and DNS poisoning to fully compromise the system.https://wearethebug.dev/posts/vl-escape/Fri, 16 Feb 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-escape/Escape is an Easy Windows machine where users can log in restricted Kiosk mode via RDP without a password. By exploiting the file:// scheme in Microsoft Edge, attackers can browse the file system, bypass restrictions, and open PowerShell. Further enumeration reveals a Remote Desktop Plus profile, whose password can be extracted using BulletsPassView, allowing admin access and UAC bypass to read the root flag.https://wearethebug.dev/posts/vl-reset/Wed, 07 Feb 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-reset/Reset is an Easy difficulty Linux machine which showcases abusing a password reset functionality in a web application following a log poisoning attack, to achieve Remote Code Execution. For privilege escalation, Rservices are abused, then a detached tmux session is used to abuse sudo privileges on nano text editor and execute commands as the root user.https://wearethebug.dev/posts/vl-lock/Fri, 19 Jan 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-lock/Lock is an Easy-rated Windows machine that involves enumerating a Gitea repository to find a Personal Access Token. This token is then used to deploy an ASPX web shell on the server, which provides an initial foothold. A password is then decrypted from an mRemoteNG configuration file, providing access to a new user account. Finally, a local privilege escalation vulnerability in the PDF24 application is exploited to obtain a shell with SYSTEM privileges.https://wearethebug.dev/posts/vl-forgotten/Fri, 08 Dec 2023 00:00:00 +0000https://wearethebug.dev/posts/vl-forgotten/Forgotten is an Easy Linux machine on VulnLab that challenges players to exploit an unfinished LimeSurvey installation by deploying a controlled MariaDB instance to gain admin access. Players then upload a malicious plugin for remote code execution inside a Docker container, discover an environment variable for host access, and escalate privileges by chaining low host access with container root privileges via a setuid binary.https://wearethebug.dev/posts/vl-retro/Fri, 11 Aug 2023 00:00:00 +0000https://wearethebug.dev/posts/vl-retro/Retro is an Easy Windows machine that showcases an Active Directory Domain Controller. Through SMB enumeration and pre-created machine account exploitation, we gain access to the system. Through the exploitation of the Active Directory Certificate Service and specifically by using the ESC1 attack, which involves exploiting certificate templates to impersonate the Administrative user, privilege escalation is achieved.https://wearethebug.dev/posts/vl-hybrid/Thu, 22 Jun 2023 00:00:00 +0000https://wearethebug.dev/posts/vl-hybrid/Hybrid is an Easy-rated, simplified Active Directory chain with 2 servers MAIL01 (Roundcube webmail) and DC01. Exploited a vulnerable Roundcube plugin via a crafted email, escalated privileges via NFS, and abused AD CS with certipy to achieve Domain Admin.https://wearethebug.dev/posts/vl-sync/Tue, 25 Apr 2023 00:00:00 +0000https://wearethebug.dev/posts/vl-sync/Sync is an Easy-rated Linux machine on the Vulnlab platform that focuses on service enumeration and exploiting an insecure Rsync configuration, custom hash cracking, and privilege escalation.https://wearethebug.dev/posts/vl-trusted/Tue, 20 Sep 2022 00:00:00 +0000https://wearethebug.dev/posts/vl-trusted/Trusted is an Easy small Active Directory chain involving two domain controllers (labdc.lab.trusted.vl and trusteddc.trusted.vl) that focuses on web vulnerabilities, local privilege escalation, and cross-domain trust abuse. An internal network access is provided with no credentials, and the goal is to assess the security posture of the AD environment.https://wearethebug.dev/posts/vl-data/Sun, 23 Jan 2022 00:00:00 +0000https://wearethebug.dev/posts/vl-data/Data is an Easy Linux machine that involves exploiting CVE-2021-43798, an arbitrary file read via path traversal in Grafana. By exploiting this vulnerability, the database file for Grafana is extracted, and the hashes in the database are converted to a format readable by Hashcat. The hash is then cracked and can be used for SSH access to the target as user boris. The compromised user has the privileges to execute docker exec as root on the system, allowing the user to escalate and obtain root access by adding the privileged flag to running containers and mounting the host filesystem.https://wearethebug.dev/posts/vl-feedback/Sun, 12 Dec 2021 00:00:00 +0000https://wearethebug.dev/posts/vl-feedback/Feedback is an Easy-rated Linux machine centered around exploiting a vulnerable Log4j input field.