> For the complete documentation index, see [llms.txt](https://1gnotus.gitbook.io/ignotus_pwn/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://1gnotus.gitbook.io/ignotus_pwn/proving-ground-practice-and-play/writeup.md). # Writeup - [MAQUINA JORDAK (Web RCE jordani 1.0.0 + PRIVESC 'env')](https://1gnotus.gitbook.io/ignotus_pwn/proving-ground-practice-and-play/writeup/maquina-jordak-web-rce-jordani-1.0.0-+-privesc-env.md) - [MAQUINA ALGERNON (VULn 'smartermail v6985 RCE')](https://1gnotus.gitbook.io/ignotus_pwn/proving-ground-practice-and-play/writeup/maquina-algernon-vuln-smartermail-v6985-rce.md) - [MAQUINA TWIGGY (CMS MEZZANINA RCE VULN ZEROMQ ZMTP o API SALTSTACK 3000.1 'cve 2020 11651')](https://1gnotus.gitbook.io/ignotus_pwn/proving-ground-practice-and-play/writeup/maquina-twiggy-cms-mezzanina-rce-vuln-zeromq-zmtp-o-api-saltstack-3000.1-cve-2020-11651.md) - [MAQUINA BOOLEAN (Modificacion de REQUEST con Burpsuite ' confirmed = true ' + LFI + UPLOAD ID\_RSA an](https://1gnotus.gitbook.io/ignotus_pwn/proving-ground-practice-and-play/writeup/maquina-boolean-modificacion-de-request-con-burpsuite-confirmed-true-+-lfi-+-upload-id_rsa-an.md) - [MAQUINA AUTHBYT (FTP anonymous y credenciales por defecto + subida de archvio PHP revershell a FTP](https://1gnotus.gitbook.io/ignotus_pwn/proving-ground-practice-and-play/writeup/maquina-authbyt-ftp-anonymous-y-credenciales-por-defecto-+-subida-de-archvio-php-revershell-a-ftp.md) - [MAQUINA CLAMV (VULN SMTP 25 'clamv' Sendmail 8.13 SEARCHSPLOIT)](https://1gnotus.gitbook.io/ignotus_pwn/proving-ground-practice-and-play/writeup/maquina-clamv-vuln-smtp-25-clamv-sendmail-8.13-searchsploit.md) - [MAQUINA COCKPIT (Gobuster extension php + Blaze CMS 'SQLI BYPASS LOGIN' + UBUNTU WEB + REVERSHELL +](https://1gnotus.gitbook.io/ignotus_pwn/proving-ground-practice-and-play/writeup/maquina-cockpit-gobuster-extension-php-+-blaze-cms-sqli-bypass-login-+-ubuntu-web-+-revershell-+.md) - [MAQUINA CODO (CODOFORUM 5.1 'RCE + UPLOAD IMG.' + LINPEAS)](https://1gnotus.gitbook.io/ignotus_pwn/proving-ground-practice-and-play/writeup/maquina-codo-codoforum-5.1-rce-+-upload-img.-+-linpeas.md) - [MAQUINA CVE-2023-40582 (Vulnerabilidad de Inyección de Comando en find exec)](https://1gnotus.gitbook.io/ignotus_pwn/proving-ground-practice-and-play/writeup/maquina-cve-2023-40582-vulnerabilidad-de-inyeccion-de-comando-en-find-exec.md) - [MAQUINA CVE-2023-46818 (RCE CVE 2023 46818 ispconfig.)](https://1gnotus.gitbook.io/ignotus_pwn/proving-ground-practice-and-play/writeup/maquina-cve-2023-46818-rce-cve-2023-46818-ispconfig..md) - [MAQUINA DC 2 (Enum Users Wordpress WPSCAN + CEWL wordlists + BruteForce WPSCAN + PRIVESC bin git 'je](https://1gnotus.gitbook.io/ignotus_pwn/proving-ground-practice-and-play/writeup/maquina-dc-2-enum-users-wordpress-wpscan-+-cewl-wordlists-+-bruteforce-wpscan-+-privesc-bin-git-je.md) - [MAQUINA DETECTION (WEB 'changedetection' port 5000 + VULN RCE 'changedetection RCE')](https://1gnotus.gitbook.io/ignotus_pwn/proving-ground-practice-and-play/writeup/maquina-detection-web-changedetection-port-5000-+-vuln-rce-changedetection-rce.md) - [MAQUINA ELECTION1 (Sito web Election 2.0 + PHPmyadmin login + Escalate Priv SERV U)](https://1gnotus.gitbook.io/ignotus_pwn/proving-ground-practice-and-play/writeup/maquina-election1-sito-web-election-2.0-+-phpmyadmin-login-+-escalate-priv-serv-u.md) - [MAQUINA DVR4 (web 'Argus Surveillance DVR version 4.0.0.0' + Vuln 'Argus Surveillance DVR DIRECTORY](https://1gnotus.gitbook.io/ignotus_pwn/proving-ground-practice-and-play/writeup/maquina-dvr4-web-argus-surveillance-dvr-version-4.0.0.0-+-vuln-argus-surveillance-dvr-directory.md) - [MAQUINA EXFILTRED Subrion CMS v4.2.1 File Upload Bypass to RCE (Authenticated) UPLOAD PHAR 'CMD' PRI](https://1gnotus.gitbook.io/ignotus_pwn/proving-ground-practice-and-play/writeup/maquina-exfiltred-subrion-cms-v4.2.1-file-upload-bypass-to-rce-authenticated-upload-phar-cmd-pri.md) - [MAQUINA FAIL (ENUM RSYNC 'PUERTO 873' + SSH- KEYGEN + PREVISEC 'GROUP FAIL2BAIN')](https://1gnotus.gitbook.io/ignotus_pwn/proving-ground-practice-and-play/writeup/maquina-fail-enum-rsync-puerto-873-+-ssh-keygen-+-previsec-group-fail2bain.md) - [MAQUINA FANTASTIC (GRAFANA 8.3 'vuln lfi' + PROMETHEUS 2.32 + ESCALATE PRIV 'group DISK = root + ID\_](https://1gnotus.gitbook.io/ignotus_pwn/proving-ground-practice-and-play/writeup/maquina-fantastic-grafana-8.3-vuln-lfi-+-prometheus-2.32-+-escalate-priv-group-disk-root-+-id_.md) - [MAQUINA FUNYBOX (CSE BOOKSTORE 1.0 Vuln rce no autenticado PRIVESC pkexec 'sudo l' extra bypass login SMALL CRM ADMIN 3.0)](https://1gnotus.gitbook.io/ignotus_pwn/proving-ground-practice-and-play/writeup/maquina-funybox-cse-bookstore-1.0-vuln-rce-no-autenticado-privesc-pkexec-sudo-l-extra-bypass-login-s.md) - [MAQUINA INTERNAL (WINDOWS SERVER 2008 + CVE 2009 3103 + METERPRETER RCE)](https://1gnotus.gitbook.io/ignotus_pwn/proving-ground-practice-and-play/writeup/maquina-internal-windows-server-2008-+-cve-2009-3103-+-meterpreter-rce.md) - [MAQUINA HUB ( Enum web port 8082 + FUGUHUB + injeccion revershell en LUA)](https://1gnotus.gitbook.io/ignotus_pwn/proving-ground-practice-and-play/writeup/maquina-hub-enum-web-port-8082-+-fuguhub-+-injeccion-revershell-en-lua.md) - [MAQUINA KEVIN (VULN HP POWER MANAGER 'admin admin' Metasploit PrivEsc 'hp manager filename' Metasploit BufferOverflow 'MANUAL')](https://1gnotus.gitbook.io/ignotus_pwn/proving-ground-practice-and-play/writeup/maquina-kevin-vuln-hp-power-manager-admin-admin-metasploit-privesc-hp-manager-filename-metasploit-bu.md) - [MAQUINA LEVRAM (Exploit GERAPY 0.9.6 RCE searchsploit + PRIVESC 'CAPABILITES python3.10')](https://1gnotus.gitbook.io/ignotus_pwn/proving-ground-practice-and-play/writeup/maquina-levram-exploit-gerapy-0.9.6-rce-searchsploit-+-privesc-capabilites-python3.10.md) - [MAQUINA MEDJED (WEBDAV BarracudaDrive 6.5 + Revershell .php creado con msfvenom + PrivEsc local barracudadrive 6.5)](https://1gnotus.gitbook.io/ignotus_pwn/proving-ground-practice-and-play/writeup/maquina-medjed-webdav-barracudadrive-6.5-+-revershell-.php-creado-con-msfvenom-+-privesc-local-barra.md) - [MAQUINA NUKEM (WORDPRESS 5.5.1 ABUSED PLUGINS SIMPLE LIST 4.4.2 PIVOTING USER MYSQL PASSOWORD PIVOTING PUERTO Y TUNELIZACION SSH PRIVESC 'DOSBOX' CAMBIO DE PERMISOS SUDOERS CON REMMINA)](https://1gnotus.gitbook.io/ignotus_pwn/proving-ground-practice-and-play/writeup/maquina-nukem-wordpress-5.5.1-abused-plugins-simple-list-4.4.2-pivoting-user-mysql-passoword-pivotin.md) - [MAQUINA PASS (FlatPass 1.2 Vuln 'file upload bypass RCE' Privesc 'apt get')](https://1gnotus.gitbook.io/ignotus_pwn/proving-ground-practice-and-play/writeup/maquina-pass-flatpass-1.2-vuln-file-upload-bypass-rce-privesc-apt-get.md) - [MAQUINA PELICAN (RCE ZooKeeper v1 Web UI + RCE + PrivEsc 'gcore pid + extract password 'strings' = root)](https://1gnotus.gitbook.io/ignotus_pwn/proving-ground-practice-and-play/writeup/maquina-pelican-rce-zookeeper-v1-web-ui-+-rce-+-privesc-gcore-pid-+-extract-password-strings-root.md) - [MAQUINA RAY PROJECT CVE 2023 6019 (COMMANDO INJECTION RAY PROJECT)](https://1gnotus.gitbook.io/ignotus_pwn/proving-ground-practice-and-play/writeup/maquina-ray-project-cve-2023-6019-commando-injection-ray-project.md) - [MAQUINA SHENZI (Enum SMB 'nullsesion' + Directory Web = Nombre del recurso compartido + WORDPRESS RC](https://1gnotus.gitbook.io/ignotus_pwn/proving-ground-practice-and-play/writeup/maquina-shenzi-enum-smb-nullsesion-+-directory-web-nombre-del-recurso-compartido-+-wordpress-rc.md) - [MAQUINA BRATARINA (SMB null session + RCE 'OPENSMTPD 2.0.0') + (MODIFICACION passwd 'agregar password' + Subscribir archivo etc passwd)](https://1gnotus.gitbook.io/ignotus_pwn/proving-ground-practice-and-play/writeup/maquina-bratarina-smb-null-session-+-rce-opensmtpd-2.0.0-+-modificacion-passwd-agregar-password-+-su.md) - [MAQUINA SQUID (web proxy SQUID 4.14 + 'RCE UPLOAD script' PHPMYADMIN 5.0.2)](https://1gnotus.gitbook.io/ignotus_pwn/proving-ground-practice-and-play/writeup/maquina-squid-web-proxy-squid-4.14-+-rce-upload-script-phpmyadmin-5.0.2.md) - [MAQUINA PC (PortForwarding port 65432 - PrivEsc 0-day 2022 rpc.py)](https://1gnotus.gitbook.io/ignotus_pwn/proving-ground-practice-and-play/writeup/maquina-pc-portforwarding-port-65432-privesc-0-day-2022-rpc.py.md) - [MAQUINA FUNBOXEASY (Enum directory - RCE .php - Pivoting User - PrivEsc SUDO-L)](https://1gnotus.gitbook.io/ignotus_pwn/proving-ground-practice-and-play/writeup/maquina-funboxeasy-enum-directory-rce-.php-pivoting-user-privesc-sudo-l.md) - [MAQUINA SLORT (Enum de directorios Acceso a la maquina con LFI and RCI PrivEsc Auto Elevated Executable Hijacking)](https://1gnotus.gitbook.io/ignotus_pwn/proving-ground-practice-and-play/writeup/maquina-slort-enum-de-directorios-acceso-a-la-maquina-con-lfi-and-rci-privesc-auto-elevated-executab.md) - [MAQUINA PASSPORT (Enum Directorios ss2john id rsa PrivEsc Creacion de archivo con permisos SUID)](https://1gnotus.gitbook.io/ignotus_pwn/proving-ground-practice-and-play/writeup/maquina-passport-enum-directorios-ss2john-id-rsa-privesc-creacion-de-archivo-con-permisos-suid.md) - [MAQUINA PYLOADER (pyload 0.5.0 Rce No autenticado)](https://1gnotus.gitbook.io/ignotus_pwn/proving-ground-practice-and-play/writeup/maquina-pyloader-pyload-0.5.0-rce-no-autenticado.md) - [MAQUINA HUTCH (Netexec LDAP enum - PrivEsc Netexec DUMP Laps)](https://1gnotus.gitbook.io/ignotus_pwn/proving-ground-practice-and-play/writeup/maquina-hutch-netexec-ldap-enum-privesc-netexec-dump-laps.md) - [MAQUINA GAARA (Brute Force SSH PrivEsc 'gdb' gtfobins)](https://1gnotus.gitbook.io/ignotus_pwn/proving-ground-practice-and-play/writeup/maquina-gaara-brute-force-ssh-privesc-gdb-gtfobins.md)