Root Quest Challenges

Space-themed Linux machine with LFI, stego, internal MySQL pivot, and privilege escalation.

Enumerate anonymous FTP, crack leaked backup hashes, SSH into the host, and escape through sudo ed.

Exploit a forgotten SAR monitoring dashboard, gain a web shell, and abuse a writable root cron script to capture the final flag.

Exploit a realistic Drupal 7 public-sector website with a Drupalgeddon2-style RCE, enumerate Linux SUID binaries, and abuse a misconfigured find binary to become root.

Enumerate a WordPress site, harvest credentials with cewl, brute-force WordPress logins with WPScan, escape a restricted bash shell via vi, and escalate to root by abusing a sudo git GTFOBins vector.

Exploit a realistic WordPress 7.0.x site with a CVE-2026-63030 batch route confusion vulnerability, extract secrets via SQL injection, create an administrator, and retrieve the root flag from a bounded diagnostic console.

Exploit a faithful Docker rebuild of the VulnHub DeathNote: 1 machine. Enumerate leaked wordlists from a WordPress site, brute-force SSH, decode esoteric clues (brainfuck, hex, base64), and escalate from user "l" to "kira" to root to read the flag.

Beginner-friendly Docker boot2root CTF. Players enumerate open ports, access an anonymous FTP share, find leaked SSH credentials, log in via SSH, and exploit a sudo misconfiguration to gain root.

A hard-difficulty, two-stage CTF on a single Joomla 5.4.9 site carrying two vulnerable third-party extensions. Import a JCE profile without authenticating to drop a PHP shell in the site temp directory, then abuse the Page Builder CK font-sync service to write a second shell as a separate service account. Two chained flags, reachable from two web ports on one host.

An operations support portal exposes internal automation services through unsafe integrations and backup workflows. Chain multiple vulnerabilities to compromise the infrastructure and obtain full root access.

Analyze a vulnerable Android banking app, exploit modern mobile API flaws, bypass client trust controls, abuse GraphQL, and replay advanced mobile workflows.

A hard-difficulty, multi-stage Harry Potter Chamber of Secrets-themed CTF. Exploit SSRF via URL authority parsing, crack weak JWT secrets, abuse PHP deserialization, and escalate to root via kernel vulnerability CVE-2024-1086 to defeat the Basilisk and capture all flags.

An insane-difficulty, multi-stage WordPress CTF. Go from an unauthenticated SSRF (URL prefix check abused via userinfo parsing) to the loopback identity gateway, forge an HS256 admin JWT, pull the user flag through an authenticated path traversal, reach www-data code execution through a weak diagnostics command runner, then SUID your way to root with a privileged chmod rule.

A complete, intentionally vulnerable CRM where a single viewer account owns everything. Escalate privileges three ways, read across workspace boundaries, land reflected and stored XSS in six HTML sinks, and turn three integration features into SSRF against an internal service to recover the billing ledger.

A multi-stage web forensic challenge. Start with directory enumeration, identify a valid user, execute a credential brute-force, bypass security-through-obscurity in robots.txt, and finally exfiltrate a flag from an undocumented API. Think like an attacker to solve the breach.

A medium-hard, multi-stage Harry Potter-themed CTF. Bypass the Ministry's enchanted login with SQL injection, exploit spell casting tools for command injection, and escalate to root to defeat Voldemort and capture all three flags.

A hard-difficulty, multi-stage Harry Potter-themed CTF built around a faithful reproduction of the Click2Shell WordPress vulnerability (pre-auth theme-install selector injection to RCE, fixed in WordPress 7.1.1). Discover the leaked Marauder's Map backup, chain Click2Shell into a web shell, then escalate to root to escape Azkaban and capture all three flags.

A medium-difficulty multi-stage WordPress CTF. Abuse the XML-RPC interface to reach a PHP object injection in Forminator Forms (< 1.57.2.1), weaponise a bundled analytics POP chain to drop a webshell, then break out with CVE-2023-22809 (sudoedit) to capture root.

A hard multi-stage WordPress CTF. Hit an unauthenticated time-based blind SQL injection (CVE-2026-3018, newsletters-lite <= 4.13), exfiltrate the admin's legacy MD5, crack it, log in and achieve RCE through the plugin uploader, then escalate to root via GNU tar checkpoint option injection.

A hard-difficulty, multi-stage internal-network CTF. Another phone is ringing: exploit an unauthenticated SQL injection in a FreePBX 17 endpoint-manager module to gain root RCE through a persisted cron job, pivot in-band from the compromised box to an embedded Metabase, and chain an authenticated H2 Java deserialization RCE to capture the root flag.