srl
OSCP Machine Index
One row per box for the whole OSCP-like list — 76 machines: 39 Linux, 18 Windows, 16 AD and 3 non-AD. Use it to pick a box by technique, to revise a path in 30 seconds, and to tick off what you have actually rooted. Detail lives in Linux, Windows and Active Directory; this page only routes you there.
How to use this page Revision: read the row, then explain the path out loud without looking at the page. If you stall on the privesc cell, open the machine page. Progress: [ ] → [x] only when you rooted it unaided (no writeup, no hint). Reset a tick if you needed help. Choosing by technique: scan the Key tool or CVE and Privesc / path columns, not the names. The Study tracks below give ready-made orders. Gaps: the Coverage check shows which phase you have been avoiding — usually the one you keep skipping. Linux Machine Foothold Privesc / path Key tool or CVE Done Enigma NFS onboarding PDF OliveTin mysqldump break-out showmount · OpenSTAManager · CVE-2026-29782 [ ] Nibbles NibbleBlog plugin upload sudo writable monitor.sh CVE-2015-6967 · NibbleBlog [ ] Solidstate Apache James admin 4555 root cron /opt/tmp.py CVE-2015-7611 · Apache James 2.3.2 · pspy32 [ ] Poison LFI log poisoning VNC secret.zip → root vncpasswd · proxychains [ ] Editor XWiki Groovy RCE ndsudo PATH hijack CVE-2025-24893 · CVE-2024-32019 [ ] Sunday finger enum → SSH 22022 sudo wget hashcat 7400 · finger-user-enum [ ] Keeper Request Tracker default creds KeePass dump → PuTTY key CVE-2023-32784 · kpcli · RT root:password [ ] Pilgrimage .git → ImageMagick read binwalk PFS traversal CVE-2022-44268 · CVE-2022-4510 [ ] Cozyhosting Spring actuator session hijack sudo ssh ProxyCommand actuator/sessions · GTFOBins ssh [ ] Codify vm2 sandbox escape glob bypass → pspy vm2 3.9.16 · pspy [ ] Tartarsauce WordPress gwolle-gb RFI sudo tar → backuperer race wpscan · GTFOBins tar [ ] Jarvis UNION SQLi → phpMyAdmin SUID systemctl unit CVE-2018-12613 · sqlmap [ ] Tabby Tomcat manager WAR deploy lxd group mount manager-script · lxd [ ] Connected FreePBX pre-auth SQLi incron writable init.conf CVE-2025-57819 · incron [ ] Mentor SNMP community → admin JWT snmpd.conf cleartext → sudo snmpwalk · COPY PROGRAM [ ] Devvortex Joomla config leak apport-cli pager CVE-2023-23752 · CVE-2023-1326 [ ] Irked UnrealIRCd backdoor shell SUID viewuser /tmp/listusers UnrealIRCd 3.2.8.1 · steghide [ ] Popcorn upload Content-Type bypass PAM MOTD passwd write CVE-2010-0832 · DirtyCow [ ] Bashed /dev/phpbash.php webshell writable /scripts cron phpbash · pspy [ ] Broker ActiveMQ OpenWire exploit sudo nginx root config CVE-2023-46604 · nginx [ ] Silentium Flowise reset-token ATO Gogs symlink → root keys CVE-2025-58434 (ATO) · CVE-2025-59528 (RCE) · CVE-2025-8110 [ ] Networked backup.tar source leak cron filename injection AddHandler · changename.sh [ ] UpDown dev header → .git source sudo easy_install setup.py phar:// · easy_install [ ] Swagshop Magento admin object injection sudo vi wildcard shoplift · Magento 1.9 [ ] Nineveh type-juggling login → LFI port knock → chkrootkit phpLiteAdmin · CVE-2014-0476 [ ] Pandora SNMP args → internal SQLi SUID backup PATH hijack snmpbulkwalk · ltrace [ ] OpenAdmin OpenNetAdmin xajax injection internal vhost → sudo nano OpenNetAdmin 18.1.1 · sudo nano [ ] Precious PDFKit URL injection sudo ruby YAML.load CVE-2022-25765 · exiftool [ ] Busqueda Searchor eval() injection full-checkup CWD hijack Searchor 2.4.0 · docker-inspect [ ] Monitored SNMP args → Nagios token getprofile symlink zip CVE-2023-40931 · getprofile.sh [ ] BoardLight Dolibarr default creds Enlightenment SUID escape CVE-2023-30253 · CVE-2022-37706 [ ] Magic SQLi login → upload bypass SUID sysinfo PATH exif_imagetype · ltrace [ ] Help GraphQL credential leak kernel 4.4.0-116 LPE CVE-2017-16995 · GraphQL [ ] Editorial SSRF to internal API GitPython ext:: clone SSRF · GitPython ext:: [ ] Builder Jenkins CLI file read admin → root SSH key CVE-2024-23897 · jenkins-cli [ ] Linkvortex dev .git → Ghost CVE sudo clean_symlink env CVE-2023-40028 · git-dumper [ ] UnderPass SNMP → daloRADIUS panel sudo mosh-server snmpwalk · mosh-client [ ] Dog Backdrop .git → module upload sudo bee eval git-dumper · bee [ ] Cctv ZoneMinder SQLi tcpdump caps → motionEye CVE-2024-51482 · CVE-2025-60787 [ ] Windows Machine Foothold Privesc / path Key tool or CVE Done Markup default creds → XXE writable job.bat as SYSTEM XXE · icacls [ ] Jerry Tomcat default creds WAR deploys as SYSTEM Tomcat 7.0.88 · msfvenom [ ] Netmon anonymous FTP = C: drive PRTG notification injection PRTG · psexec [ ] Servmon NVMS-1000 path traversal NSClient++ 0.5.2.35 NSClient++ · 8443 tunnel [ ] Chatterbox AChat UDP overflow Alfred ACL → root.txt AutoRunScript · icacls [ ] Jeeves Jenkins no-auth console KeePass PTH → ADS KeePass · psexec -hashes [ ] Sniper LFI → session poisoning weaponized .chm Out-CHM · AppLocker [ ] Querier xlsm macros → MSSQL creds xp_dirtree → GPP cpassword olevba · GPP [ ] Giddy stacked SQLi xp_dirtree UniFi taskkill.exe hijack xp_dirtree · Ebowla [ ] Bounty IIS upload null byte SeImpersonate → LonelyPotato web.config · LonelyPotato [ ] Arctic ColdFusion FCKeditor upload MS10-059 kernel MS10-059 · exploit-suggester [ ] Remote NFS Umbraco.sdf XSLT RCE → TeamViewer AES Umbraco · TeamViewer 7 [ ] Buff Gym Management upload CloudMe overflow via Chisel Chisel · CloudMe 1.11.2 [ ] Love TLS cert vhost → SSRF AlwaysInstallElevated → SYSTEM AlwaysInstallElevated · msiexec [ ] Secnotes XSRF password reset SMB share → WSL history CSRF · WSL rootfs [ ] Access FTP mdb + PST cmdkey → runas /savecred runas /savecred · DPAPI [ ] Mailing traversal → hMailServer.ini CVE-2024-21413 → CVE-2023-2255 CVE-2024-21413 · CVE-2023-2255 [ ] Heist guest portal Cisco config Firefox dump → admin reuse Cisco type 7 · procdump [ ] Active Directory Machine Foothold Privesc / path Key tool or CVE Done Active anonymous Replication share GPP → Kerberoast Administrator gpp-decrypt · GetUserSPNs [ ] Forest null RPC → AS-REP roast WriteDacl domain → DCSync GetNPUsers · secretsdump [ ] Sauna kerbrute → AS-REP fsmith AutoLogon → GetChanges kerbrute · secretsdump [ ] Flight UNC include → NetNTLMv2 machine TGT → DCSync ntlm_theft · Rubeus tgtdeleg [ ] Return printer panel LDAP bind Server Operators binPath swap Responder · Server Operators [ ] Blackfield profiles share → AS-REP ForceChangePassword → SeBackup rpcclient setuserinfo2 · diskshadow [ ] Cicada guest SMB → HR note spray → reg save SAM netexec –rid-brute · reg save [ ] TheFrizz Gibbon LMS file write GPO abuse → SYSTEM CVE-2023-45878 · SharpGPOAbuse · hashcat 1420 [ ] Administrator assumed breach → BloodHound GenericAll chain → DCSync BloodHound · targetedKerberoast [ ] Monteverde querydispinfo → user spray ADSync LocalDB → DA ADSync · mcrypt.dll [ ] Escape SMB PDF creds → MSSQL coerce → ESC1 Certipy ESC1 · xp_dirtree [ ] EscapeTwo assumed breach → xlsx WriteOwner → ESC4 → ESC1 Certipy ESC4 · bloodyAD [ ] Certified assumed breach → WriteOwner shadow creds → ESC9 Certipy ESC9 · owneredit [ ] Puppy assumed breach → HR group KeePassXC → DPAPI KeePassXC · dpapi.py [ ] Timelapse null SMB zip → pfx cert WinRM → LAPS pfx2john · LAPS [ ] Signed assumed breach SQL login silver ticket → OPENROWSET ticketer.py · OPENROWSET [ ] Also on the list (not AD) Linux boxes that sit in the AD column of the source sheet but have no domain, no Kerberos and no BloodHound. They belong with the web → Linux privesc cluster.