OSCP Machine Index

On this page

One row per box for the whole OSCP-like list — 76 machines: 39 Linux, 18 Windows, 16 AD and 3 non-AD. Use it to pick a box by technique, to revise a path in 30 seconds, and to tick off what you have actually rooted. Detail lives in Linux, Windows and Active Directory; this page only routes you there.

How to use this page

Revision: read the row, then explain the path out loud without looking at the page. If you stall on the privesc cell, open the machine page.
Progress: [ ] → [x] only when you rooted it unaided (no writeup, no hint). Reset a tick if you needed help.
Choosing by technique: scan the Key tool or CVE and Privesc / path columns, not the names. The Study tracks below give ready-made orders.
Gaps: the Coverage check shows which phase you have been avoiding — usually the one you keep skipping.

Linux

Machine	Foothold	Privesc / path	Key tool or CVE	Done
Enigma	NFS onboarding PDF	OliveTin mysqldump break-out	showmount · OpenSTAManager · CVE-2026-29782	[ ]
Nibbles	NibbleBlog plugin upload	sudo writable monitor.sh	CVE-2015-6967 · NibbleBlog	[ ]
Solidstate	Apache James admin 4555	root cron /opt/tmp.py	CVE-2015-7611 · Apache James 2.3.2 · pspy32	[ ]
Poison	LFI log poisoning	VNC secret.zip → root	vncpasswd · proxychains	[ ]
Editor	XWiki Groovy RCE	ndsudo PATH hijack	CVE-2025-24893 · CVE-2024-32019	[ ]
Sunday	finger enum → SSH 22022	sudo wget	hashcat 7400 · finger-user-enum	[ ]
Keeper	Request Tracker default creds	KeePass dump → PuTTY key	CVE-2023-32784 · kpcli · RT root:password	[ ]
Pilgrimage	.git → ImageMagick read	binwalk PFS traversal	CVE-2022-44268 · CVE-2022-4510	[ ]
Cozyhosting	Spring actuator session hijack	sudo ssh ProxyCommand	actuator/sessions · GTFOBins ssh	[ ]
Codify	vm2 sandbox escape	glob bypass → pspy	vm2 3.9.16 · pspy	[ ]
Tartarsauce	WordPress gwolle-gb RFI	sudo tar → backuperer race	wpscan · GTFOBins tar	[ ]
Jarvis	UNION SQLi → phpMyAdmin	SUID systemctl unit	CVE-2018-12613 · sqlmap	[ ]
Tabby	Tomcat manager WAR deploy	lxd group mount	manager-script · lxd	[ ]
Connected	FreePBX pre-auth SQLi	incron writable init.conf	CVE-2025-57819 · incron	[ ]
Mentor	SNMP community → admin JWT	snmpd.conf cleartext → sudo	snmpwalk · COPY PROGRAM	[ ]
Devvortex	Joomla config leak	apport-cli pager	CVE-2023-23752 · CVE-2023-1326	[ ]
Irked	UnrealIRCd backdoor shell	SUID viewuser /tmp/listusers	UnrealIRCd 3.2.8.1 · steghide	[ ]
Popcorn	upload Content-Type bypass	PAM MOTD passwd write	CVE-2010-0832 · DirtyCow	[ ]
Bashed	/dev/phpbash.php webshell	writable /scripts cron	phpbash · pspy	[ ]
Broker	ActiveMQ OpenWire exploit	sudo nginx root config	CVE-2023-46604 · nginx	[ ]
Silentium	Flowise reset-token ATO	Gogs symlink → root keys	CVE-2025-58434 (ATO) · CVE-2025-59528 (RCE) · CVE-2025-8110	[ ]
Networked	backup.tar source leak	cron filename injection	AddHandler · changename.sh	[ ]
UpDown	dev header → .git source	sudo easy_install setup.py	phar:// · easy_install	[ ]
Swagshop	Magento admin object injection	sudo vi wildcard	shoplift · Magento 1.9	[ ]
Nineveh	type-juggling login → LFI	port knock → chkrootkit	phpLiteAdmin · CVE-2014-0476	[ ]
Pandora	SNMP args → internal SQLi	SUID backup PATH hijack	snmpbulkwalk · ltrace	[ ]
OpenAdmin	OpenNetAdmin xajax injection	internal vhost → sudo nano	OpenNetAdmin 18.1.1 · sudo nano	[ ]
Precious	PDFKit URL injection	sudo ruby YAML.load	CVE-2022-25765 · exiftool	[ ]
Busqueda	Searchor eval() injection	full-checkup CWD hijack	Searchor 2.4.0 · docker-inspect	[ ]
Monitored	SNMP args → Nagios token	getprofile symlink zip	CVE-2023-40931 · getprofile.sh	[ ]
BoardLight	Dolibarr default creds	Enlightenment SUID escape	CVE-2023-30253 · CVE-2022-37706	[ ]
Magic	SQLi login → upload bypass	SUID sysinfo PATH	exif_imagetype · ltrace	[ ]
Help	GraphQL credential leak	kernel 4.4.0-116 LPE	CVE-2017-16995 · GraphQL	[ ]
Editorial	SSRF to internal API	GitPython ext:: clone	SSRF · GitPython ext::	[ ]
Builder	Jenkins CLI file read	admin → root SSH key	CVE-2024-23897 · jenkins-cli	[ ]
Linkvortex	dev .git → Ghost CVE	sudo clean_symlink env	CVE-2023-40028 · git-dumper	[ ]
UnderPass	SNMP → daloRADIUS panel	sudo mosh-server	snmpwalk · mosh-client	[ ]
Dog	Backdrop .git → module upload	sudo bee eval	git-dumper · bee	[ ]
Cctv	ZoneMinder SQLi	tcpdump caps → motionEye	CVE-2024-51482 · CVE-2025-60787	[ ]

Windows

Machine	Foothold	Privesc / path	Key tool or CVE	Done
Markup	default creds → XXE	writable job.bat as SYSTEM	XXE · icacls	[ ]
Jerry	Tomcat default creds	WAR deploys as SYSTEM	Tomcat 7.0.88 · msfvenom	[ ]
Netmon	anonymous FTP = C: drive	PRTG notification injection	PRTG · psexec	[ ]
Servmon	NVMS-1000 path traversal	NSClient++ 0.5.2.35	NSClient++ · 8443 tunnel	[ ]
Chatterbox	AChat UDP overflow	Alfred ACL → root.txt	AutoRunScript · icacls	[ ]
Jeeves	Jenkins no-auth console	KeePass PTH → ADS	KeePass · psexec -hashes	[ ]
Sniper	LFI → session poisoning	weaponized .chm	Out-CHM · AppLocker	[ ]
Querier	xlsm macros → MSSQL creds	xp_dirtree → GPP cpassword	olevba · GPP	[ ]
Giddy	stacked SQLi xp_dirtree	UniFi taskkill.exe hijack	xp_dirtree · Ebowla	[ ]
Bounty	IIS upload null byte	SeImpersonate → LonelyPotato	web.config · LonelyPotato	[ ]
Arctic	ColdFusion FCKeditor upload	MS10-059 kernel	MS10-059 · exploit-suggester	[ ]
Remote	NFS Umbraco.sdf	XSLT RCE → TeamViewer AES	Umbraco · TeamViewer 7	[ ]
Buff	Gym Management upload	CloudMe overflow via Chisel	Chisel · CloudMe 1.11.2	[ ]
Love	TLS cert vhost → SSRF	AlwaysInstallElevated → SYSTEM	AlwaysInstallElevated · msiexec	[ ]
Secnotes	XSRF password reset	SMB share → WSL history	CSRF · WSL rootfs	[ ]
Access	FTP mdb + PST	cmdkey → runas /savecred	runas /savecred · DPAPI	[ ]
Mailing	traversal → hMailServer.ini	CVE-2024-21413 → CVE-2023-2255	CVE-2024-21413 · CVE-2023-2255	[ ]
Heist	guest portal Cisco config	Firefox dump → admin reuse	Cisco type 7 · procdump	[ ]

Active Directory

Machine	Foothold	Privesc / path	Key tool or CVE	Done
Active	anonymous Replication share	GPP → Kerberoast Administrator	gpp-decrypt · GetUserSPNs	[ ]
Forest	null RPC → AS-REP roast	WriteDacl domain → DCSync	GetNPUsers · secretsdump	[ ]
Sauna	kerbrute → AS-REP fsmith	AutoLogon → GetChanges	kerbrute · secretsdump	[ ]
Flight	UNC include → NetNTLMv2	machine TGT → DCSync	ntlm_theft · Rubeus tgtdeleg	[ ]
Return	printer panel LDAP bind	Server Operators binPath swap	Responder · Server Operators	[ ]
Blackfield	profiles share → AS-REP	ForceChangePassword → SeBackup	rpcclient setuserinfo2 · diskshadow	[ ]
Cicada	guest SMB → HR note	spray → reg save SAM	netexec –rid-brute · reg save	[ ]
TheFrizz	Gibbon LMS file write	GPO abuse → SYSTEM	CVE-2023-45878 · SharpGPOAbuse · hashcat 1420	[ ]
Administrator	assumed breach → BloodHound	GenericAll chain → DCSync	BloodHound · targetedKerberoast	[ ]
Monteverde	querydispinfo → user spray	ADSync LocalDB → DA	ADSync · mcrypt.dll	[ ]
Escape	SMB PDF creds → MSSQL	coerce → ESC1	Certipy ESC1 · xp_dirtree	[ ]
EscapeTwo	assumed breach → xlsx	WriteOwner → ESC4 → ESC1	Certipy ESC4 · bloodyAD	[ ]
Certified	assumed breach → WriteOwner	shadow creds → ESC9	Certipy ESC9 · owneredit	[ ]
Puppy	assumed breach → HR group	KeePassXC → DPAPI	KeePassXC · dpapi.py	[ ]
Timelapse	null SMB zip → pfx	cert WinRM → LAPS	pfx2john · LAPS	[ ]
Signed	assumed breach SQL login	silver ticket → OPENROWSET	ticketer.py · OPENROWSET	[ ]

Also on the list (not AD)

Linux boxes that sit in the AD column of the source sheet but have no domain, no Kerberos and no BloodHound. They belong with the web → Linux privesc cluster.

Machine	Foothold	Privesc / path	Key tool or CVE	Done
Gobox	Go template SSTI	backdoored nginx module	SSTI · LocalStack	[ ]
Bucket	LocalStack S3 upload	pd4ml attachment read	LocalStack · pd4ml	[ ]
Facts	Camaleon CMS admin	sudo facter –custom-dir	CVE-2024-46987 · facter	[ ]

Study tracks

Six orders through the same 76 boxes. Each one assumes the previous is comfortable; skip ahead only if you can already explain the privesc step.

Web → shell first — Nibbles, Devvortex, Cozyhosting, Magic, Networked, Tabby, Busqueda, Pilgrimage. One app bug, one shell, no AD. Do these before anything that needs Kerberos.
Linux privesc ladder — Sunday, Bashed, Nibbles, Codify, Broker, Tabby, BoardLight, Cctv. sudo → writable script → cron → group → SUID → capabilities, in that order.
Windows starter set — Jerry, Netmon, Bounty, Querier, Giddy, Access. Web or file-share foothold, then an ACL, service or SeImpersonate step.
AD starter set (unauthenticated) — Active, Forest, Cicada, Monteverde, Escape, Timelapse. No starting creds: share, null RPC, guest or a document is the way in.
Assumed breach → DA — Administrator, Certified, EscapeTwo, Puppy, Signed. Start with a login; finish with BloodHound, shadow creds or a silver ticket.
Harder / multi-stage — Silentium, Editor, Linkvortex, Builder, TheFrizz, Blackfield. Two or three pivots before root/DA; expect revert timers and cleanup scripts.

Coverage check

Counted by tagging every row above against the page it came from. A box appears under each phase it needs, so the column is not meant to sum to 76.

Phase / technique	Boxes	Examples
Credentials & enumeration	36	Enigma, Netmon, Monteverde
Web / service → shell	57	Devvortex, Bounty, Return
Linux privesc	42	Broker, Tabby, BoardLight
Windows privesc	22	Markup, Bounty, Buff
AD (ACL, Kerberos, ADCS)	16	Forest, Certified, Signed
Pivot / hidden service	8	Pandora, Buff, Cctv

Sanity check: the Linux privesc count (42) equals the 39 Linux machines plus the 3 non-AD Linux machines — every Linux box in the list requires a Linux privesc step. The Windows privesc count (22) exceeds the 18 Windows machines because the AD boxes also require Windows-side escalation. The AD count (16) matches the AD table exactly. Before an exam run: at least one ticked box per row, and no phase left at zero.