To get user, I found the thing to get to the spiky thing, but I can’t get the snake to get me into the box for some reason.
Great box,
I didn’t end up getting user, just root.
I used metasploit to exploit the service at the end of the tunnel. There will be two ways you can take, they are not the same even though they might look like it at first glance. Only one of them will work.
PM me if you need a nudge
Rooted !
I love this machine !
Very realistic !
DM me for nudges !
Rooted!! I enjoyed a lot doing this machine. Feel free to DM if you are stuck!!
Was trying to get user, but ended up getting root straight from initial foothold! Lol!
Note for others:
Initial Foothold:
Remember Breadcrumbs? This machine is almost like that. You’ve to follow a chain of small steps.
The basic enumeration steps and googling will open the right doors.
User:
Don’t know yet. Will update once I find this.
Edit: Found it.
We can read stuff, even though it says we can’t.
Root:
Just like Initial Foothold, we have to follow a chain of exploits.
Do your basic local enumeration work like looking at common locations, listening services etc well.
Once the first gate is opened, hacktricks will guide you to root, if you know the basics.
Goodluck.
Rooted, if anyone needs help DM me
Very cool box! Great!
PM me if you stuck
Pwned! Medium machine not hard!
Foothold:
Check pl*gins, may be CVE?
User:
Default enumeration
Root:
Ah, ■■■■, may be CVE again?
Thanks @TheCyberGeek! PM me if you need help.
Rooted! thx @TheCyberGeek for this nice machine!
I found getting user pretty straightforward … but it took me ages to get root!!
DM if stucked 
boy that was a fun box, I was completely stuck on the endgame, a hint in this discussion was helpful to point in the right direction for a PoC…
hey , i am kinda stuck after getting user , i can see 8**3 , but not geeting write cve? anyone can help
Stuck with root. Think I am going down a rabbit hole.
I finally got root. When I used a mak*f**e, I kept getting a folder did not exist, I had to hard code a version different from the actual uname -r. Is this intended? It ended up working when I hardcoded a lesser version. but I am surprised the actual modules did not exist for the current version.
Finally rooted. Was stuck for a long time on the initial foothold because of my poor enumeration, so here are some tips: - Initial Foothold: When you find that first door and start fuzzing it, you can find what you need without f*** d**********. I found it using them first, but it doesn’t always seem to work and there is a much much easier way. Maybe check some default files for a hint? - User: If you see some weird permissions, Google what happens when only those are present. - Root: Multiple steps, first you dig and then you escape. When escaping, if it won’t c*****, then check what h****** are present on the system and force it to use those, one of them will work for sure.
Rooted , DM me if you need a hint 
Type your comment> @EF3X0S said: > Rooted , DM me if you need a hint i have a problem with i****d. how do you fix that? i got a “Invalid …” error
Type your comment> @cyberic said: > I finally got root. When I used a mak*f**e, I kept getting a folder did not exist, I had to hard code a version different from the actual uname -r. Is this intended? It ended up working when I hardcoded a lesser version. but I am surprised the actual modules did not exist for the current version. actually i do it too. but i cant go any further. can you help me?
nice machine. rooted.
my only tip would be:
don’t overthink about escaping a non privileged container. because you are not suppose to be escaping it.
my dms are open to help for newcomers. im around.
[in the end youll be like this](
)