Boot2root-CTFs-Writeups - Write-ups / walkthroughs of 'boot to root' Capture

项目说明

Boot to root CTFs

Walkthroughs and notes of 'boot to root' CTFs mostly from that I did for fun. I like to use VMs from (in addition to the ones I create) to organize hands-on penetration testing training sessions for junior security auditors/consultants :-)

>> Classic pentest methodology to do a Boot2root CTF <<

Step 1 - Scanning and enumeration

##### *Useful tools:* Nmap (network port scanner and (NSE) scripts), Burp proxy (manual & automated Web security testing tool), Nikto (Web scanner), Dirb & Gobuster (URL bruteforcers), Kali tools, scripts (source:Github/your owns).*
-------------------

Step 2 - Gaining access

##### *Useful tools:* scripts, webshells, and reverse shells (source:Github/your owns), Kali tools, ExploitDB & searchsploit (public exploit database), Burp proxy (manual & automated Web security testing), Sqlmap (automatic SQL injection & DB takeover tool), kadimus (LFI exploit tool), Metasploit framework (penetration testing framework), Impacket framework & CrackMapExec (Windows en pentesting tools), Hydra / thc-hydra / ncrack (password bruteforce tools), DB (uni database tool).
-------------------------------

Step 3 - Post-exploitation and Pri escalation to become "root" or "Local System"

##### *Useful tools:* scripts such as LinEnum (Linux enumeration scripts), LinPEAS & WinPEAS (Linux & Windows enumeration scripts), Linux Exploit suggester / Linux Exploit suggester 2 (scripts to assess Linux kernel security hardening and exposure on publicly known exploits), PowerUp PowerShell script & SharpUP (Windows pri escalation tools), ExploitDB & searchsploit (public exploit database), Metasploit framework (penetration testing framework), ...
------------------------------

Step 4 - Pi techniques to attack a second VM (or docker containers) only reachable from the 1rst one (some CTFs ha containers :-))

##### *Useful tools:* Metasploit framework (penetration testing framework), Rpivot / SOCAT / Ligolo (reverse socks proxies for penetration tests), Tunna / ReGeorg / Neo-reGeorg (pi with TCP tunnelling over HTTP ), ...
---------------------------------

Other - Mapping between a few boot2root CTFs and common /exploits

| Boot2root CTF | Anonymous access or Weak password | Insecure file upload function | Webshell | SQLi | LFI | RFI | XXE | OS cmd injection | XSS | Unpatched RCE flaw | Docker privesc | Info / Note |
| :---: | :---: | :---: | :---: | :---: | :---: | :---: | :---: | :---: | :---: | :---: | :---: | :---: |
| *Credit Card Scammers* | - | - | X | X | - | - | - | - | X | - | - | - |
| *Billu-b0x2* | - | - |- | - | - | - | - | - | - | X | - | Drupal CMS |
| *Bobby* | X | - | X | - | - | - | - | - | - | - | - | - |
| *CloudAV* | - | - | - | - | - | - | - | X | - | - | - | - |
| *DC:8* | - | - | X | X | - | - | - | - | - | - | - | Drupal CMS |
| * Docker:1* | X | - | X | - | - | - | - | - | - | - | X | WordPress CMS & Pi technique |
| *Freshly* | - | - | X | X | - | - | - | - | - | - | - | - |
| *Fristileaks.1.3* | - | X | X | - | - | - | - | - | - | - | - | - |
| *HackLab * | X | - | - | - | - | - | - | - | - | - | - | - |
| *MinU:v2* | - | - | - | - | - | - | X | - | - | - | - |
| *Mr Robot* | X | - | X | - | - | - | - | - | - | - | - | WordPress CMS |
| *SafeHarbor:1* | - | - | - | X | X | X | - | - | - | X | X |Pi technique |
| *Scream* | X | - | X | - | - | - | - | - | - | X | - | - |
| *SickOS.1.1* | X | - | X | - | - | - | - | - | - | X | - | Pi technique |
| *SickOS.1.2* | - | - | X | - | - | - | - | - | - | - | - | - |
| *Stapler* | X | - | X | - | X | - | - | - | - | - | - | - |
| *Tr0ll1* | X | - | - | - | - | - | - | - | - | - | - | - |
| *Typhoon* | X | - | X | - | - | - | - | - | - | X | - | - |
| ** | - | - | - | X | - | - | - | - | - | X | - | Drupal CMS |
| *WinterMute* | X | - | X | - | X | - | - | - | - | X | - | Pi technique |

项目信息

开发语言：未知

Star 数：63

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Write-ups / walkthroughs of 'boot to root' Capture The Flag (CTF) challenges展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。