CTF思路
点击放大
Offsec-Practice-Labs - Offsec Practice Labs is a curated training arsenal
项目说明
eCPPTv3/OSCP/CPTS Preparation Arsenal
This repository contains a curated list of machines, notes, and resources targeting the eCPPT, OSCP and CPTS exams.
It covers , , HackMy, HackTheBox, PortSwigger and HackingHub targets, plus
self-hosted labs and full AD ranges you can run offline.
![LinkedIn]()
![Blog]()
![Website]()
![X]()
<p align="center">
<img src=" width="1000" />
</p>
---
eCPPT/OSCP/CPTS Exam Domains & Labs
The following machines are categorized by the specific skill sets required for the eCPPT exam.
1. Resource De & Initial Access
*Focus: Enumeration, Brute-force, Shells, Old School Exploits.*
| Machine / Room | Platform | Difficulty | Focus | Cost | Link |
| :--- | :--- | :--- | :--- | :--- | :--- |
| Basic | | Low | CUPS, SSH Brute-force, env SUID, Misconfiguration | Free | Download |
| Beginner | | Low | UDP, TFTP, TFTP Brute-force, sudo html2text | Free | Download |
| Exec | | Low | SMB, SMB Shares, PHP, sudo bash | Free | Download |
| Fing | | Low | finger, Finger user enumeration, SSH Brute-force, doas | Free | Download |
| Fuser | | Low | CUPS, C, Dash suid, RCE | Free | Download |
| Lower | | Low | VHost Fuzzing, SSH Brute-force, Group writable | Free | Download |
| Lower4 | | Low | ident, SSH Brute-force, sudo multitail, Misconfiguration | Free | Download |
| Lower6 | | Low | Redis, Redis Brute-force, SSH Brute-force, Capabilities | Free | Download |
| Lower7 | | Low | FTP, FTP Brute-force, Node.js, shadow Group | Free | Download |
| Noob | | Low | id_rsa Cracking, su Brute-force, Misconfiguration | Free | Download |
| Absolute | | Easy | SMB, HTTP GET Brute-force, PHP, sudo rclone | Free | Download |
| APex | | Easy | OSINT, finger, SQLite, SSH Brute-force | Free | Download |
| Basic Pentesting 1 | | Beg | Web to Root | Free | Download |
| Beep | HackTheBox | Easy | Web/Asterisk | VIP | HTB Link |
| Call | | Easy | UDP, SIP, Md5 Cracking, sudo (CVE) | Free | Download |
| EasyPeasy | HackMyVM | Easy | Web/Shells | Free | HMV Link |
| Fire | | Easy | FTP, Anonymous FTP, Firefox decrypt, Cockpit | Free | Download |
| Friendly | HackMyVM | Easy | FTP/SSH | Free | HMV Link |
| Gift | HackMyVM | Easy | Basic Enumeration | Free | HMV Link |
| Kioptrix Level 1 | | Beg | SMB, Apache, mod_ssl | Free | Download |
| Kioptrix Level 1.1 | | Beg | SQL Injection, RCE | Free | Download |
| Kioptrix Level 1.2 | | Beg | LotusCMS | Free | Download |
| Kioptrix Level 1.3 | | Beg | SQLi, Restricted Shell | Free | Download |
| Lame | HackTheBox | Easy | Enumeration/Samba | VIP | HTB Link |
| LazySysAdmin 1 | | Beg | Info Disclosure | Free | Download |
| Lookup | | Easy | DNS, Reverse DNS Lookup, DNS Zone Transfer, SSH Brute-force | Free | Download |
| Mission 1 | HackingHub | Easy | Basic Recon | Free | Start Mission |
| Open | | Easy | Openplc, Default Creds, HTTP GET Brute-force, Ttyd | Free | Download |
| RickdiculouslyEasy 1 | | Beg | Multiple Paths | Free | Download |
| Swamp | | Easy | DNS, DNS Zone Transfer, Command Injection, Misconfiguration | Free | Download |
| Yadis | | Easy | SMB, Redis, sudo yaegi, Misconfiguration | Free | Download |
| Belial | | Medium | FTP, Anonymous FTP, FTP Brute-force, KeePass | Free | Download |
| Bulldog 1 | | Int | Django, Hidden Files | Free | Download |
| Bund | | Medium | rsync, rsync Brute-force, rsync Enumeration, Jekyll | Free | Download |
| Chain | | Medium | UDP, SNMP, SNMP Community String Brute-force, SNMP Enumeration | Free | Download |
| Cronos | HackTheBox | Medium | DNS/Web | VIP | HTB Link |
| Dark | | Medium | UDP, SNMP, SNMP Community String Brute-force, SNMP Enumeration | Free | Download |
| Discover | | Medium | SMB, RPC Enumeration, SMB Brute-force, SMB Shares | Free | Download |
| HackLAB: | | Int | General Pentest | Free | Download |
| Hunter | | Medium | DNS, DNS Zone Transfer, File Upload, sudo bsh | Free | Download |
| Kioptrix 2014 | | Int | Web Exploits | Free | Download |
| Mission 2 | HackingHub | Medium | Foothold | Free | Start Mission |
| NullByte | | Int | General Pentest | Free | Download |
| Prime 1 | | Int | General Pentest | Free | Download |
| pWnOS 2.0 | | Int | Old School | Free | Download |
| SickOs 1.1 | | Int | Squid Proxy, Shellshock | Free | Download |
| SickOs 1.2 | | Int | PUT Method, Cron Jobs | Free | Download |
| SkyTower 1 | | Int | SSH Tunneling | Free | Download |
| Stapler 1 | | Int | SMB Enum, Password Spraying | Free | Download |
| System | | Medium | Redis, Redis Brute-force, FTP Brute-force, Redis module | Free | Download |
| Tr0ll 1 | | Int | FTP, Binary Analysis | Free | Download |
| Unbaked Pie | HackMyVM | Medium | Docker/Pi | Free | HMV Link |
| 2 | | Int | General Pentest | Free | Download |
| Denied | | Hard | SSH Enumeration, SSH Brute-force, doas, Misconfiguration | Free | Download |
| Raw | | Hard | SNMP, SNMP Community String Brute-force, SNMP Enumeration, SMB | Free | Download |
| Tr0ll 2 | | Hard | Deep Rabbit Holes | Free | Download |
| Blue | TryHackMe | - | EternalBlue (MS17-010) | Free | THM Link |
| Bounty Hacker | TryHackMe | - | FTP/SSH Attacks | Free | THM Link |
| Hydra | TryHackMe | - | Brute-forcing | Free | THM Link |
| Nmap Live Host Discovery | TryHackMe | - | Network Scanning | Free | THM Link |
| | TryHackMe | - | Upload | Free | THM Link |
2. Web Application Penetration Testing
*Focus: SQLi, XSS, LFI, RCE, Manual Exploitation.*
| Machine / Room | Platform | Difficulty | Focus | Cost | Link |
| :--- | :--- | :--- | :--- | :--- | :--- |
| Blogger | | Low | WordPress, CMS, WP User Enum, WP Brute | Free | Download |
| Deploy | | Low | Tomcat, Default Creds, WAR, sudo ex | Free | Download |
| Diff3r3ntS3c | | Low | File Upload, PHP, Cron, RCE | Free | Download |
| Loweb | | Low | SQLi, LFI, sudo chown, Misconfiguration | Free | Download |
| Lower5 | | Low | LFI, Log Poisoning, sudo bash, Gpg Cracking | Free | Download |
| Wicca | | Low | Node.js, Command Injection, sudo links | Free | Download |
| Arpon | | Easy | File Upload, PHP, Zip Cracking, sudo arp | Free | Download |
| Automation | | Easy | VHost Fuzzing, Li, C, Git | Free | Download |
| Bank | | Easy | SMB, SMB Shares, JWT, Bcrypt Cracking | Free | Download |
| Base | HackMyVM | Easy | Basic Web | Free | HMV Link |
| Blog | | Easy | Nibbleblog, CMS, HTTP POST Brute-force, File Upload | Free | Download |
| Cibercamp | | Easy | WordPress, CMS, WP File Manager, C | Free | Download |
| Code | | Easy | Pluck, CMS, Default Creds, File Upload | Free | Download |
| Druid | | Easy | VHost Fuzzing, HotelDruid, C, sudo perl | Free | Download |
| Explorer | | Easy | Extplorer, PHP, Misconfiguration, RCE | Free | Download |
| External | | Easy | VHost Fuzzing, XXE, MySQL, sudo mysql | Free | Download |
| Horizontall | HackTheBox | Easy | Strapi CMS | VIP | HTB Link |
| Load | | Easy | RiteCMS, CMS, Default Creds, File Upload | Free | Download |
| MailForge | | Easy | SSTI, File Upload, Eml file, C | Free | Download |
| Method | | Easy | HTTP Methods, PHP, Wildcard Injection, Misconfiguration | Free | Download |
| Northwing | | Easy | LFI, PHP Wrappers, MySQL, Bcrypt Cracking | Free | Download |
| Ober | | Easy | October, CMS, Default Creds, Misconfiguration | Free | Download |
| Panel | HackMyVM | Easy | Admin Panel Bypass | Free | HMV Link |
| Photographer 1 | | Beg | Web/SMB | Free | Download |
| Printer | | Easy | Command Injection, Screen suid, Misconfiguration | Free | Download |
| Ready | | Easy | Redis, PHP, disk Group, id_rsa Cracking | Free | Download |
| Remote | | Easy | WordPress, CMS, WP Gwolle Plugin, C | Free | Download |
| Sales | | Easy | VHost Fuzzing, HTTP POST Brute-force, SuiteCRM, C | Free | Download |
| Serve | | Easy | WebDAV, KDBX Cracking, HTTP GET Brute-force, HTTP Methods | Free | Download |
| Service | | Easy | Joomla, CMS, C, PHP | Free | Download |
| Twitx | | Easy | File Upload, PHP, Bcrypt Cracking, sudo ascii85 | Free | Download |
| Unit | | Easy | HTTP Methods, PHP, sudo su, sudo xargs | Free | Download |
| 1 | | Beg | CMS Enumeration | Free | Download |
| Web App Mission 1 | HackingHub | Easy | Common Web Vulns | Free | Start Mission |
| YourWAF | | Easy | VHost Fuzzing, Command Injection, WAF, API | Free | Download |
| Zone | | Easy | DNS, DNS Zone Transfer, File Upload, PHP | Free | Download |
| Access | | Medium | WebSocket, FTP Brute-force, PHP 5, sudo perl | Free | Download |
| Billu: b0x | | Int | SQLi, RCE, LFI | Free | Download |
| Breach 1.0 | | Int | Traffic Analysis, SSL | Free | Download |
| Breach 2.1 | | Int | Traffic Analysis | Free | Download |
| Ceres | | Medium | LFI, PHP Wrappers, Log Poisoning, sudo python | Free | Download |
| DC-9 | | Int | SQLi Search, LFI | Free | Download |
| Deathnote 1 | | Int | LFI, RCE, Upload | Free | Download |
| DevGuru 1 | | Int | Web Focus | Free | Download |
| EID | | Medium | VHost Fuzzing, HTTP POST Brute-force, SSTI, RCE | Free | Download |
| Express | | Medium | API, API Enumeration, HTTP Verb Tampering, SSRF | Free | Download |
| FristiLeaks 1.3 | | Int | LFI to Shell, PrivEsc | Free | Download |
| Future | | Medium | SSRF, LFI, id_rsa Cracking, Docker SUID | Free | Download |
| Hacksudo: Thor | | Int | CGI-bin, Shellshock | Free | Download |
| JarJar | | Medium | LFI, Ab suid, Yescrypt Cracking, Misconfiguration | Free | Download |
| Jenk | | Medium | LFI, Jenkins, Bcrypt Cracking, Hping3 ping | Free | Download |
| Kyubi | | Medium | Grafana, C–43798, Path Tra, Redis | Free | Download |
| LemonSqueezy | | Int | Web | Free | Download |
| Mr-Robot 1 | | Int | Wordpress, Keys, Decoding | Free | Download |
| MyWAF | | Medium | VHost Fuzzing, WAF, MySQL, Capabilities | Free | Download |
| PwnLab: init | | Int | LFI, PHP Filters, Cmd Inj | Free | Download |
| Raven 1 | | Int | Wordpress, PHPMailer | Free | Download |
| Raven 2 | | Int | PHPMailer RCE | Free | Download |
| Registry | HackMyVM | Medium | Docker Registry/Web | Free | HMV Link |
| Reset | | Medium | LFI, SSRF, Command Injection, Find suid | Free | Download |
| Sandwich | | Medium | VHost Fuzzing, HTTP POST Brute-force, sudo chvt | Free | Download |
| Shared | | Medium | WordPress, Wordpress plugin site editor, C, LFI | Free | Download |
| Site | HackMyVM | Medium | Web Exploitation | Free | HMV Link |
| Spooisong | | Medium | PHP, LFI, Log Poisoning, Dns spoofing | Free | Download |
| TheDoor | | Medium | FTP, Anonymous FTP, SQLi, IDOR | Free | Download |
| Tom | | Medium | LFI, Tomcat, WAR, sudo ascii85 | Free | Download |
| W34kn3ss 1 | | Int | Web/PrivEsc | Free | Download |
| Web App Mission 2 | HackingHub | Medium | Ad Web Vulns | Free | Start Mission |
| WebSploit2018 | | Int | Apps Collection | Free | Download |
| Blind XSS Masterclass | HackingHub | Ad | XSS | Paid | Course Link |
| GoldenEye 1 | | Hard | POP3, Compilation | Free | Download |
| Hands-On Web Exploitation Course | HackingHub | Ad | Web Vulns | Paid | Course Link |
| Headache | | Hard | API, API Enumeration, Api rest, SSRF | Free | Download |
| Init | | Hard | Command Injection, Git, SQLite, XXE | Free | Download |
| Jerry | | Hard | File Upload, XXE, PHP, sudo node | Free | Download |
| Mirage | | Hard | API, API Enumeration, Reverse engineering, Suid binary | Free | Download |
| Nuclei Masterclass | HackingHub | Ad | Scanning | Paid | Course Link |
| Pinkys Palace v1 | | Hard | SQLi, Dictionary Attacks | Free | Download |
| Pinkys Palace v2 | | Hard | Proxy Tunneling, SQLi | Free | Download |
| Pressed | HackTheBox | Hard | WordPress/XML-RPC | VIP | HTB Link |
| SlyWindow | | Hard | VHost Fuzzing, Stego, XSS, API | Free | Download |
| Solar | | Hard | XSS, Mqtt, LFI, PHP | Free | Download |
| Trace | | Hard | NFS, Nfs enumeration, VHost Fuzzing, Type juggling | Free | Download |
| Wrapp | | Hard | SSRF, PHP Wrappers, LFI, Tomcat | Free | Download |
| Yincana | | Hard | XSS, IDOR, LFI, id_rsa Cracking | Free | Download |
| Authentication & Logic | PortSwigger | - | Bypassing Controls | Free | Start Lab |
| Burp Suite Basics | TryHackMe | - | Proxy Interception | Paid | THM Link |
| Command Injection | PortSwigger | - | OS Command Execution | Free | Start Lab |
| Cross-Site Request Forgery | PortSwigger | - | CSRF Token Bypass | Free | Start Lab |
| Cross-Site Scripting (XSS) | PortSwigger | - | Reflected, Stored, DOM | Free | Start Lab |
| Directory Tra | PortSwigger | - | File Path Tra | Free | Start Lab |
| File Inclusion | TryHackMe | - | LFI/RFI/Path Tra | Paid | THM Link |
| OWASP Juice Shop | TryHackMe | - | Modern Web Exploitation | Free | THM Link |
| OWASP Top 10 | TryHackMe | - | Critical Web Vulns | Free | THM Link |
| Ser Request Forgery | PortSwigger | - | SSRF & Cloud Metadata | Free | Start Lab |
| SQL Injection (All Labs) | PortSwigger | - | Manual SQLi Mastery | Free | Start Lab |
| SQL Injection Lab | TryHackMe | - | Manual/Automated SQLi | Free | THM Link |
| XML External Entity (XXE) | PortSwigger | - | Injection & Retrieval | Free | Start Lab |
3. Network Security & Pi
*Focus: Recon, Lateral Mo, Tunneling. (Requires Lab Setup)*
| Machine / Room | Platform | Difficulty | Focus | Cost | Link |
| :--- | :--- | :--- | :--- | :--- | :--- |
| Care | | Easy | LFI, Squid, Log Poisoning, sudo perl | Free | Download |
| Goetia | | Easy | Command Injection, Port Forwarding, PHP Filter Chain, LD_PRELOAD | Free | Download |
| Hidden | | Easy | UDP, TFTP, PHP, sudo dash | Free | Download |
| Observer | | Easy | SSH Brute-force, X11, X11 Forwarding, Env Vars | Free | Download |
| Psymin | | Easy | PHP, PsySH, id_rsa Cracking, Port Forwarding | Free | Download |
| ShadowBlocks | | Easy | iSCSI, 7z Cracking, Port Forwarding, NFS no_root_squash | Free | Download |
| Anon | | Medium | Log Poisoning, Pi, SSH Brute-force, Docker Group | Free | Download |
| Baal | | Medium | C, ICMP Tunneling, RCE | Free | Download |
| Bola | | Medium | rsync, rsync Brute-force, Port Forwarding, IDOR | Free | Download |
| Cache | | Medium | Squid, SSH Brute-force, sudo python3, Writable /etc/passwd | Free | Download |
| ExposedDev | | Medium | VHost Fuzzing, LFI, Git, Port Forwarding | Free | Download |
| Hat | | Medium | LFI, IPv6, FTP, FTP Brute-force | Free | Download |
| Internal | | Medium | LFI, Port Forwarding, Vnc, Misconfiguration | Free | Download |
| Key | | Medium | IPv6, Redis, sudo perl, sudo runc | Free | Download |
| Leak | | Medium | Jenkins, Cve‑2024‑23897, IPv6, sudo wkhtmltopdf | Free | Download |
| Responder | | Medium | LFI, PHP Wrappers, id_rsa Cracking, IPv6 | Free | Download |
| Static | | Medium | rsync, rsync Brute-force, Node.js, Nodejs ecstatic | Free | Download |
| SummarizeThis | | Medium | Ai, Prompt injection, PostgreSQL, Port Forwarding | Free | Download |
| Unbaked Pie | HackMyVM | Medium | Docker Pi | Free | HMV Link |
| Vault | HackTheBox | Medium | SSH Tunneling | VIP | HTB Link |
| Cap | | Hard | ident, IPv6, SSH Brute-force, GRUB | Free | Download |
| Gattaca | | Hard | HTTP GET Brute-force, Command Injection, Port Forwarding, FTP Brute-force | Free | Download |
| Gen | | Hard | SSH Brute-force, Port Forwarding, sudo puttygen | Free | Download |
| Lang | | Hard | UDP, SNMP, SNMP Community String Brute-force, SNMP Enumeration | Free | Download |
| Lost | | Hard | VHost Fuzzing, SQLi, Port Forwarding, Command Injection | Free | Download |
| Machine | HackMyVM | Hard | Internal Network | Free | HMV Link |
| Monitor | | Hard | VHost Fuzzing, HTTP GET Brute-force, PHP, Log Poisoning | Free | Download |
| Travel | | Hard | LFI, IPv6, rsync, Log Poisoning | Free | Download |
| Tunnel | | Hard | Squid, FTP, Zip Cracking, sudo bash | Free | Download |
| WinterMute | HackMyVM | Hard | (Clone of Lab) | Free | HMV Link |
| Reddish | HackTheBox | Insane | Chisel/Socat Pi | VIP | HTB Link |
| Lateral Mo | TryHackMe | - | Moving through Windows | Paid | THM Link |
| Metasploitable 3 | GitHub | - | Setup as dual-homed target. | Free | GitHub |
| myHouse7 | | - | Docker/Subnet pi. | Free | Download |
| Pi | TryHackMe | - | Proxychains, sshuttle, Chisel | Paid | THM Link |
| Symfonos Series | | - | Good for internal service chains. | Free | Download |
| WinterMute 1 | | - | Best for Pi. Dual-VM lab. | Free | Download |
| Wpwn 1 | | - | Dual NICs designed for pi. | Free | Download |
| Wreath | TryHackMe | - | Full Pi Network (Must Do) | Free* | THM Link |
4. Exploit De
*Focus: Stack Buffer O.*
| Machine / Room | Platform | Difficulty | Focus | Cost | Link |
| :--- | :--- | :--- | :--- | :--- | :--- |
| Buffer | HackMyVM | Medium | Stack O | Free | HMV Link |
| Bunker | | Medium | SCTP, Default Creds, Tomcat, WAR | Free | Download |
| Debug | | Medium | UDP, SNMP, SNMP Community String Brute-force, gdbserver | Free | Download |
| Encode | | Medium | Node.js, node-serialize, Deserialization, sudo gcc | Free | Download |
| October | HackTheBox | Medium | Buffer O (ASLR/NX) | VIP | HTB Link |
| O | HackMyVM | Medium | Binary Exploitation | Free | HMV Link |
| Brainpan | HackMyVM | Hard | (Clone/Similar) | Free | HMV Link |
| De | | Hard | LFI, IPv6, rsync, disable_functions Bypass | Free | Download |
| O | HackTheBox | Hard | Buffer O | VIP | HTB Link |
| Transfer | | Hard | VHost Fuzzing, PHP Wrappers, Command Injection, Port Forwarding | Free | Download |
| Brainpan 1 | | - | The King of BoF. Do this until you dream in hex. | Free | Download |
| Brainpan 2 | | - | Ad Binary Exploitation. | Free | Download |
| Brainpan | TryHackMe | - | THM Port of Machine | Free | THM Link |
| Buffer O Prep | TryHackMe | - | Tib3rius Room (TryHackMe). | Free | THM Link |
| Gatekeeper | TryHackMe | - | Binary Exploitation | Free | THM Link |
| Intro To Pwntools | TryHackMe | - | Scripting Exploits. | Free | THM Link |
| Smasher | | - | Web to Buffer O. | Free | Download |
| Stack O for Beginners | | - | Linear progression BoF. | Free | Download |
| Sudo Buffer O | TryHackMe | - | C | Free | THM Link |
5. Post-Exploitation & Pri Escalation
*Focus: Linux PrivEsc, Cron jobs, SUID, Kernel exploits.*
| Machine / Room | Platform | Difficulty | Focus | Cost | Link |
| :--- | :--- | :--- | :--- | :--- | :--- |
| Agent | | Low | WebS, sudo c99, sudo ssh-agent | Free | Download |
| Doctor | | Low | LFI, id_rsa Cracking, Writable /etc/passwd, Misconfiguration | Free | Download |
| First | | Low | Raspberry Pi, Default Creds, rbash, rbash Bypass | Free | Download |
| HackingStation | | Low | Command Injection, sudo nmap, Misconfiguration | Free | Download |
| Infected | | Low | Backdoor, Apache mod_backdoor, sudo service, sudo joe | Free | Download |
| Look | | Low | SSH Brute-force, Env Vars, sudo nokogiri, Misconfiguration | Free | Download |
| Lower2 | | Low | Telnet, Telnet Brute-force, shadow Group, Shadow writable | Free | Download |
| Lower3 | | Low | NFS, NFS no_root_squash, Misconfiguration, RCE | Free | Download |
| Mux | | Low | Stego, strings, rlogin, sudo tmux | Free | Download |
| Network | | Low | Command Injection, sudo ip, RCE, Misconfiguration | Free | Download |
| Node | | Low | Node red, sudo node, Misconfiguration, RCE | Free | Download |
| Plot | | Low | VHost Fuzzing, sar2html, sudo ssh, Wildcard Injection | Free | Download |
| Real | | Low | Unrealircd, C, Cron, Hosts writable | Free | Download |
| Robot | | Low | Stego, MongoDB, SSH Brute-force, sudo sh | Free | Download |
| Share | | Low | Weborf, C, LFI, id_rsa Cracking | Free | Download |
| Shock | | Low | Shellshock, C, cgi-bin, sudo busybox | Free | Download |
| Zero | | Low | PHP 8.1.0-de, Backdoor, sudo wine, RCE | Free | Download |
| Air | | Easy | File Upload, sudo vifm, Misconfiguration | Free | Download |
| Alpine | | Easy | Git, Cron, Misconfiguration | Free | Download |
| Blind | | Easy | Blind command injection, sudo jshell, Misconfiguration | Free | Download |
| Brain | | Easy | LFI, sudo wfuzz, Python Library Hijacking | Free | Download |
| Flash | | Easy | SSTI, sudo expect, RCE, Misconfiguration | Free | Download |
| Friends | | Easy | OSINT, MySQL, MySQL Brute-force, Mysql load_file | Free | Download |
| Hit | | Easy | Git, Knock, Port knocking, id_rsa Cracking | Free | Download |
| Hook | | Easy | Htmlawed, C, sudo perl, sudo iex | Free | Download |
| Memory | | Easy | Memcache, SSH Brute-force, sudo wormhole, Misconfiguration | Free | Download |
| Misstep | | Easy | API, Docker, Docker Group, Cron | Free | Download |
| Play | | Easy | Musicco, Path Tra, Arbitrary directory download, SSH Brute-force | Free | Download |
| Plex | | Easy | Sslh, Multiplexer, JWT, sudo mutt | Free | Download |
| Return | HackTheBox | Easy | Windows/Ser | VIP | HTB Link |
| Send | | Easy | rsync, Cron, Apt writable, Misconfiguration | Free | Download |
| Shop | | Easy | SQLi, Sqli time based, SSH Brute-force, Capabilities | Free | Download |
| Slash | | Easy | Nginx misconfigured, Path Tra, SSH Brute-force, sudo aoss | Free | Download |
| Bind | | Medium | SCTP, sudo wtfutil, Misconfiguration | Free | Download |
| Chimera | | Medium | Gitea, Git, C–1086 | Free | Download |
| Coliseum | | Medium | IDOR, PostgreSQL, su Brute-force, sudo busybox | Free | Download |
| Escalate | HackMyVM | Medium | SUID/Sudo Abuse | Free | HMV Link |
| Hellman | | Medium | _TBA_ | Free | Download |
| Jeeves | HackTheBox | Medium | Windows/RottenPotato | VIP | HTB Link |
| Listen | | Medium | id_rsa Cracking, C, Cron, Cron Hijacking | Free | Download |
| LostTape | | Medium | Git, LFI, Xinetd, Bof | Free | Download |
| Mail | | Medium | LFI, Smtp, Mail poisoning, sudo mail | Free | Download |
| Matrix | | Medium | Pcap, Stego, Wildcard Injection, sudo rsync | Free | Download |
| PrivEsc Mission | HackingHub | Medium | Linux PrivEsc | Free | Start Mission |
| PrivEsc | HackMyVM | Medium | Multi- Escalation | Free | HMV Link |
| Safeguard | | Medium | Tomcat, C, Cron, Cron Hijacking | Free | Download |
| Secrets | | Medium | HTTP POST Brute-force, id_rsa Cracking, sudo date, sudo jed | Free | Download |
| Toxin | HackMyVM | Medium | Kernel Exploits | Free | HMV Link |
| Uni | | Medium | Moodle, C, KDBX Cracking, sudo git | Free | Download |
| Volt | | Medium | _TBA_ | Free | Download |
| Zerotrace | | Medium | LFI, sudo chattr, Cron, Ethereum Cracking | Free | Download |
| Annunciation | | Hard | Command Injection, Cron, C, Misconfiguration | Free | Download |
| Backdoor | | Hard | Backdoor, HTTP POST Brute-force, Writable apache2.conf, sudo bettercap | Free | Download |
| QuartzLock | | Hard | _TBA_ | Free | Download |
| DC-1 | | - | SUID Abuse. | Free | Download |
| DC-2 | | - | Restricted Shell. | Free | Download |
| DC-3 | | - | Kernel Exploit. | Free | Download |
| DC-4 | | - | Sudo Abuse. | Free | Download |
| DC-5 | | - | Screen Exploit. | Free | Download |
| DC-6 | | - | Script Abuse. | Free | Download |
| Escalate_Linux 1 | | - | 12+ Methods of Escalation. | Free | Download |
| Lin.Security | | - | Dedicated PrivEsc Practice. | Free | Download |
| Linux for Hackers Course | HackingHub | Intermediate | Linux Skills | Paid | Course Link |
| Linux PrivEsc | TryHackMe | - | Full Linux Escalation Course | Paid | THM Link |
| Post-Exploitation Basics | TryHackMe | - | Mimikatz, Bloodhound, Powerview | Paid | THM Link |
| PrivEsc Arena | TryHackMe | - | Multi- Practice | Paid | THM Link |
| Temple of Doom | | - | Node.js / Serialization. | Free | Download |
| Tommy Boy 1 | | - | Sudo Abuse. | Free | Download |
| Windows PrivEsc | TryHackMe | - | Full Windows Escalation Course | Paid | THM Link |
6. Acti & Red Teaming
*Focus: Kerberoasting, AS-REP, Domain Dominance.*
> WARNING: is weak for AD. Use these resources instead.
| Machine / Room | Platform | Difficulty | Focus | Cost | Link |
| :--- | :--- | :--- | :--- | :--- | :--- |
| Build | | Low | Jenkins, Default Creds, Misconfiguration, RCE | Free | Download |
| Eternal | | Low | SMB, MS17-010, C, EternalBlue | Free | Download |
| Experience | | Low | SMB, MS08-067, C, NetAPI | Free | Download |
| Active | HackTheBox | Easy | Kerberoasting/GPP | VIP | HTB Link |
| Admin | | Easy | SMB Brute-force, WinRM, PowerShell History, Misconfiguration | Free | Download |
| Carlam | | Easy | NFS, SMB, RID Brute, SSH Brute-force | Free | Download |
| Dump | | Easy | FTP, Anonymous FTP, SAM/SYSTEM Dump, NTLM Cracking | Free | Download |
| Hosting | | Easy | SMB, SMB Brute-force, RPC Enumeration, WinRM | Free | Download |
| Magic | | Easy | SMB, SMB RID Brute, SMB Brute-force, SMB Shares | Free | Download |
| Policy | | Easy | Zip Cracking, GPP, groups.xml, GPP Decrypt | Free | Download |
| Sauna | HackTheBox | Easy | AD Enumeration | VIP | HTB Link |
| SRV | | Easy | FTP, Anonymous FTP, IIS, ASPX | Free | Download |
| Store | | Easy | IIS, File Upload, ASPX, SeImpersonatePri | Free | Download |
| Sun | | Easy | SMB, SMB RID Brute, SMB Brute-force, SMB Shares | Free | Download |
| War | | Easy | Tomcat, Default Creds, WAR, SeImpersonatePri | Free | Download |
| Change | | Medium | Acti, SMB Brute-force, Kerberos, LDAP | Free | Download |
| Controler | | Medium | Acti, SMB Brute-force, Kerberos, LDAP | Free | Download |
| Misconfigured | | Medium | Acti, SMB Brute-force, LDAP, LDAP Enumeration | Free | Download |
| Monteverde | HackTheBox | Medium | Azure AD Traits | VIP | HTB Link |
| Tech | | Medium | LFI, PHP, Log Poisoning, Misconfiguration | Free | Download |
| AD Course | HackingHub | Ad | Full AD Compromise | Paid | Course Link |
| AD Mission | HackingHub | Hard | AD Exploitation | Free | Start Mission |
| AD | HackMyVM | Hard | Basic AD Chain | Free | HMV Link |
| Blackfield | HackTheBox | Hard | Forensics/AD | VIP | HTB Link |
| Domain | HackMyVM | Hard | Kerberos Attacks | Free | HMV Link |
| Manager | | Hard | UDP, SNMP, SNMP Community String Brute-force, SNMP Enumeration | Free | Download |
| School | | Hard | LFI, Tomcat, WAR, SeImpersonatePri | Free | Download |
| Sizzle | HackTheBox | Hard | Deep AD | VIP | HTB Link |
| Controller | HackMyVM | Insane | Full Forest Compromise | Free | HMV Link |
| GOAD | GitHub | - | Full Lab | Free | GitHub |
| | | - | Cloud Lab | Paid | Website |
| Acti Basics | TryHackMe | - | AD Fundamentals | Free | THM Link |
| Attackti | TryHackMe | - | Kerberos, Impacket, Domain Admin | Free | THM Link |
| Breaching Acti | TryHackMe | - | Initial Access in AD | Free | THM Link |
| Dante | HackTheBox | - | Pro Lab | Paid | HTB Link |
| HTB ProLabs | HackTheBox | - | Cloud Lab | Paid | Website |
| Lateral Mo in AD | TryHackMe | - | Spreading through the Domain | Paid | THM Link |
| Metasploitable 3 | GitHub | - | Local Lab | Free | GitHub |
| Offshore | HackTheBox | - | Pro Lab | Paid | HTB Link |
| Post-Exploitation Basics | TryHackMe | - | Persistence & Looting | Paid | THM Link |
| RastaLabs | HackTheBox | - | Pro Lab | Paid | HTB Link |
| Zephyr | HackTheBox | - | Pro Lab | Paid | HTB Link |
---
Malware Analysis
| Machine / Room | Platform | Difficulty | Focus | Cost | Link |
| :--- | :--- | :--- | :--- | :--- | :--- |
| Basic Malware RE | TryHackMe | - | Re Fundamentals | Free | THM Link |
| Carnage | TryHackMe | - | C2 Simulation | Free | THM Link |
| Dunkle Materie | TryHackMe | - | Packed Malware | Free | THM Link |
| History of Malware | TryHackMe | - | Intro to Malware | Free | THM Link |
| MAL: Malware Introductory | TryHackMe | - | Basic Concepts | Free | THM Link |
| MAL: Researching | TryHackMe | - | Analysis & Research | Free | THM Link |
| Mobile Malware Analysis | TryHackMe | - | Android/iOS Malware | Free | THM Link |
Reverse Engineering
| Machine / Room | Platform | Difficulty | Focus | Cost | Link |
| :--- | :--- | :--- | :--- | :--- | :--- |
| Aster | TryHackMe | - | Decompiling Python | Free | THM Link |
| CC: Ghidra | TryHackMe | - | Ghidra Tool | Free | THM Link |
| CC: Radare2 | TryHackMe | - | Radare2 Tool | Free | THM Link |
| Classic Passwd | TryHackMe | - | Binary Re | Free | THM Link |
| Intro to x86-64 | TryHackMe | - | Assembly Basics | Free | THM Link |
| J Engineering | TryHackMe | - | Ja | Free | THM Link |
| REloaded | TryHackMe | - | Challenges | Free | THM Link |
| Reverse Engineering | TryHackMe | - | RE Fundamentals | Free | THM Link |
| Re ELF | TryHackMe | - | Linux ELF Binaries | Free | THM Link |
| Windows x64 Assembly | TryHackMe | - | Windows Assembly | Free | THM Link |
Hard CTF / Challenges
| Machine / Room | Platform | Difficulty | Focus | Cost | Link |
| :--- | :--- | :--- | :--- | :--- | :--- |
| All Hard Machines | HackTheBox | Hard | | VIP | HTB Link |
| doubletrouble: 1 | | Hard | Misconfigs/PrivEsc | Free | Download |
| Empire: Breakout | | Hard | Ad | Free | Download |
| Hacksudo: FOG | | Hard | Web/Linux PrivEsc | Free | Download |
| Hacksudo: Thor | | Hard | Unique PrivEsc | Free | Download |
| Hard | HackMyVM | Hard | Ad Exploits | Free | HMV Link |
| Metasploitable 3 | | Hard | Windows Exploit | Free | GitHub |
| SickOS 1.2 | | Hard | Masterful Exploitation | Free | Download |
| Temple of Doom | | Hard | Obscure Puzzles | Free | Download |
| Tr0ll 2 | | Hard | Deep Exploitation | Free | Download |
| : 1 | | Hard | Lateral Mo | Free | Download |
| All Insane Machines | HackTheBox | Insane | | VIP | HTB Link |
| Insane | HackMyVM | Insane | Complex Challenges | Free | HMV Link |
| Borderlands | TryHackMe | - | Boot2Root | Free | THM Link |
| Brainpan 1 | TryHackMe | - | Buffer O | Paid | THM Link |
| Daily Bugle | TryHackMe | - | CMS Exploitation | Paid | THM Link |
| Internal | TryHackMe | - | Pi/AD | Paid | THM Link |
| Iron Corp | TryHackMe | - | Web/Linux Exploit | Paid | THM Link |
| Jeff | TryHackMe | - | Boot2Root | Paid | THM Link |
| Motunui | TryHackMe | - | Boot2Root | Free | THM Link |
| Ra | TryHackMe | - | AD/Internal Network | Paid | THM Link |
| Retro | TryHackMe | - | Boot2Root | Free | THM Link |
| Spring | TryHackMe | - | Web App Hacking | Paid | THM Link |
| Squid Game | TryHackMe | - | Malware/RE | Paid | THM Link |
| : dotjar | TryHackMe | - | Ja | Paid | THM Link |
---
Labs & Ranges
Full multi-host en for practising lateral mo, AD attacks and detection engineering.
These are the closest free stand-ins for the OSCP challenge labs and the CPTS/eCPPTv3 internal-network
sections.
Labs
| Lab | Type | Focus | Cost | Link |
| :--- | :--- | :--- | :--- | :--- |
| HackLabs | Self-hosted | Curated collection & guided paths | Free | GitHub |
| Metasploitable 3 | Self-hosted () | Windows Server 2008 + Ubuntu targets, dual-homed for pi | Free | GitHub |
| HackMyVM | Downloadable VMs | 400+ boot2root machines, free flag submission & ladder | Free | Website |
| | Downloadable VMs | 179 free boot2root VMs, listed by domain above | Free | Website |
| DetectionLab | Self-hosted (/Terraform) | Blue-team telemetry: Splunk, Sysmon, osquery, | Free | GitHub |
| Windows Attack & Defense Lab | Self-hosted | Windows/AD attack paths paired with defensi | Free | GitHub |
Ranges
| Range | Type | Focus | Cost | Link |
| :--- | :--- | :--- | :--- | :--- |
| GOAD v3 | Multi-domain AD range | Kerberoasting, AS-REP, delegation, trust abuse, ADCS. The free AD range | Free | GitHub |
| | Cloud range | Chained AD/Windows labs, OSCP+ difficulty | Paid | Website |
| HTB Pro Labs | Cloud range | Dante, RastaLabs, Offshore, Zephyr | Paid | Website |
GOAD lab : pick one that fits your hardware; all ship in the same repo and deploy via
/Ansible (, , Proxmox, or Azure pro).
| | Size | Topology | Link |
| :--- | :--- | :--- | :--- |
| MINILAB | 2 VMs | 1 forest, 1 domain (1 DC + 1 Win10 workstation) | Docs |
| GOAD-Light | 3 VMs | 1 forest, 2 domains. Start here on a smaller PC | Docs |
| GOAD | 5 VMs | 2 forests, 3 domains. The full lab | Docs |
| SCCM | 4 VMs | 1 forest, 1 domain with Microsoft Configuration Manager | Docs |
| DRACARYS | 3 VMs | Challenge lab, 1 domain, no schema provided | Docs |
| NHA | 5 VMs | Challenge lab, 2 domains, no schema provided | Docs |
---
License
This project is licensed under the MIT License.
You are free to use, modify, and distribute this toolkit for personal or commercial purposes, provided that the original copyright
notice and this permission notice are included in all copies or substantial portions of the software.
See the full license text in the MIT License.
项目信息
开发语言：未知
Star 数：261
技术要点
该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Offsec Practice Labs is a curated training arsenal for hands-on prep across eCPPTv3, OSCP, and CPTS.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。
从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。
使用与学习建议
1. 下载源码压缩包，解压到本地环境。
2. 根据项目类型准备对应的运行环境与依赖。
3. 按照 README 中的步骤完成配置与部署。
4. 在隔离的测试环境中运行验证，避免影响生产系统。
免责声明
本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。
| 资源标题 | Offsec-Practice-Labs - Offsec Practice Labs is a curated training arsenal |
| 所属分类 | CTF思路 |
| 发布作者 | admin |
| 发布时间 | 2026-10-05 23:45:20 |
| 下载权限 | 免费下载 |
| 附件数量 | 2 个下载链接 |
| 浏览次数 | 339 |
| 讨论数量 | 0 |
| 主题状态 | 正常讨论中 |