0xdf hacks stuff

SmartHire is a Linux box hosting an AI-powered HR site that trains AI models to score resumes.

Hercules is a Windows domain controller running an ASP.NET site.

Ghostlink is built around a fictional threat group running its operations on a Windows domain controller, with a message broker quietly announcing infrastructure I can’t otherwise reach.

Silentium hosts an investment firm website with a staging subdomain running Flowise, a visual AI agent builder.

Pirate is a Windows assume-breach Active Directory box, providing credentials for a low-privileged domain account.

Nexus hosts a Krayin CRM instance backed by a Gitea server.

Cobblestone hosts a cluster of Minecraft-themed PHP sites across a few subdomains.

Helix builds an industrial control theme around a chemical reactor that operators monitor and adjust through a control server.

Kobold hosts several services behind an Nginx reverse proxy, including an MCPJam inspector instance, a PrivateBin paste site, and an Arcane Docker management panel.

Fries is an assume breach Windows box that hides a sprawl of Linux services behind the domain controller.

Logging is a Windows domain controller offered as an assume breach box, starting with credentials for a low privileged domain user.

Orion is a Linux box running a Craft CMS website.

CCTV hosts a ZoneMinder surveillance install.

Abducted is a Linux box running Samba.

DevArea hosts a freelance developer marketplace backed by several web applications on different stacks.

WingData runs a Wing FTP Server instance with anonymous access enabled.

NanoCorp is a Windows Active Directory machine built around a careers portal that accepts uploaded application archives.

VariaType hosts a pair of websites for a font foundry, a Flask-based font generator and a PHP validation portal.

Facts is a Linux box hosting a trivia website built on the Camaleon CMS, a Ruby on Rails application.

AI as a technology is moving fast.

Interpreter is a Linux box hosting Mirth Connect, a Java-based healthcare integration engine.

MonitorsFour continues the Monitors series, this time on a Windows host.

Pterodactyl hosts a Minecraft community site alongside an instance of the Pterodactyl game-server management panel.

Overwatch starts with anonymous SMB access to a software share that hosts a custom .NET monitoring binary.

Sorcery is a Linux box with a Rust Rocket web app backed by Neo4j, Gitea, and a Kafka message bus.

AirTouch simulates a wireless network environment.

Eighteen is a Windows Server 2025 assume-breach box starting with MSSQL credentials.

DarkZero is an assume breach Windows box with two forests connected by a bidirectional cross-forest trust.

Snapped is a Linux box hosting a static site behind nginx, with an Nginx UI admin panel.

Principal is a Linux box with a Java web application using pac4j for JWT authentication.

Browsed is a Linux box hosting a browser extension repository where uploaded extensions are tested in a headless Chrome instance.

Conversor is a Linux box hosting a Flask web application that converts nmap XML output to HTML using XSLT.

Gavel is a Linux box hosting a PHP auction website with an exposed .git directory.

Expressway is a Linux box with only SSH and an IKE VPN service on UDP.

Barrier is a Linux box with GitLab, Authentik, and Apache Guacamole.

Guardian is a Linux box hosting a university portal built with PHP.

Bruno is a Windows Active Directory box.

Giveback starts with a WordPress website with a donation plugin that’s vulnerable to a RCE exploit.

Soulmate has a PHP-based dating website, as well as an instance of CrushFTP.

Slonik showcases some interesting Linux techniques around NFS and PostgreSQL.

Breach is a Windows domain controller box.

Signed is an assume breach Windows box where I’m given credentials for a local MSSQL account.

Bamboo offers a Squid HTTP proxy through which I’ll access a PaperCut NG instance.

CodeTwo is a Linux box hosting a developer sandbox where users can execute JavaScript code.

Members of the NetExec team created a small lab as a CTF for the Barbhack conference that took place in August 2025 in the South of France.

JobTwo is the sequel to Job, another Windows box from VulnLab released on HackTheBox.

Job is a Windows box with a website saying that they are looking for resumes in Libre Office format.

Imagery hosts a Flask-based image gallery application.

HackNet hosts a social media site for hackers built with Django.

Previous starts with a NextJS application for a fictional JavaScript framework.