XUT_ / MACHINES

Machines

Write-ups, labs and vulnerable machines.

PLATFORM
STATUS
DIFFICULTY
TAGS
109 MACHINES
0109

Daily Bugle

THMMACHINENONEHARD
ApacheBrute ForceCommand ExecutionCVEDatabaseEnumerationHTTPJoomlaLinuxPassword CrackingPHPPivotingPort ScanningPrivilege EscalationRCEReverse ShellSQL InjectionSSHWebWeb Enumerationyum
WRITE-UP ↗
0108

Internal

THMMACHINENONEHARD
ApacheBrute ForceCommand ExecutionCTFDatabaseDockerEnumerationFTPGroovyHTTPHydraJenkinsLinuxNginxPHPPort ScanningPrivilege EscalationRCERDPReverse ShellSMBSSHSSH TunnelingWebWeb EnumerationWildcard InjectionWiresharkWordPress
WRITE-UP ↗
0107

Plant Photographer

THMMACHINENONEHARD
APICommand ExecutionEnumerationHTTPJavaLFILinuxPath TraversalPythonPython ScriptingRCEReverse ShellSSRFWebWeb EnumerationWerkzeug
WRITE-UP ↗
0106

Intermediate Nmap

THMMACHINENONEEASY
EnumerationHTTPLinuxNetworkPort ScanningProtocol AnalysisRDPSSH
WRITE-UP ↗
0105

Scheme Catcher

THMMACHINENONEINSANE
ASLRBrute ForceBuffer OverflowCommand ExecutionContainer EscapeDockerDocker EscapeEnumerationFile System Mount AbuseglibcHeap ExploitationHex EditingHouse of WaterLinuxNetworkPort ScanningPrivilege EscalationProtocol Reverse EngineeringRCEReverse EngineeringSource Code AnalysisUse-After-FreeWebWeb Enumeration
WRITE-UP ↗
0104

Jackpot

THMMACHINENONEMEDIUM
Binary ProtocolEnumerationHTTPLinuxNetworkPort ScanningProtocol AnalysisProtocol Reverse EngineeringPythonPython ScriptingWebWeb Enumeration
WRITE-UP ↗
0103

Stream

HTBMACHINERETIREDMEDIUM
ClickHouseCommand ExecutionCredential CaptureDatabaseDNS EnumerationEnumerationHTTPHydraKafkaKopiaLFILinuxPassword CrackingPort ScanningPrivilege EscalationPythonRCEScheduled Task AbuseService AbuseSSHSubdomain EnumerationWeb EnumerationXXE
WRITE-UP ↗
0102

Touch

HTBMACHINERETIREDEASY
Command ExecutionDatabaseEnumerationHTTPNetworkPort ScanningPrivilege EscalationRCERDPReverse ShellUDFWeb EnumerationWindows
WRITE-UP ↗
0101

The Rust Dance

CTFMACHINENONEHARD
CTFTalent ArenaWindowsLinuxPythonNetworkReverse EngineeringRust
WRITE-UP ↗
0100

Companion API

CTFMACHINENONEMEDIUM
CTFTalent ArenaWebDockerAPIJWT
WRITE-UP ↗
0099

The Digital Treasure Hunt

CTFMACHINENONEEASY
CTFTalent ArenaOSINTGitGit History
WRITE-UP ↗
0098

Layover

HTBMACHINERETIREDMEDIUM
LinuxWebRDPSSHWiresharkHTTPNetworkCredential CaptureCVECUPSDatabaseCryptographyPivotingPrivilege EscalationSudoPHPWirelessWi-FiCVE-2026-31857CVE-2026-34990
WRITE-UP ↗
0097

Bedside

HTBMACHINERETIREDMEDIUM
LinuxDockerFile UploadCVEpdfminer.sixInsecure DeserializationPath TraversalSSHPyTorchSudoPrivilege EscalationWebPythonReverse ShellPHPSUID/SGIDAI
WRITE-UP ↗
0096

Paperwork

HTBMACHINERETIREDEASY
LinuxLPDCommand InjectionPJLPath TraversalArbitrary File WriteUnix SocketFile DescriptorSSHPythonPrivilege EscalationWebEnumerationCryptography
WRITE-UP ↗
0095

MakeSense

HTBMACHINERETIREDMEDIUM
LinuxWebWordPressXSSPythonAESReverse ShellSSHOCRPrivilege EscalationSSH TunnelingCredential CaptureCryptographyFile UploadJavaScriptPHPAPIJSONCronSUID/SGIDAIApache
WRITE-UP ↗
0094

Ledger

THMMACHINENONEHARD
WindowsActive DirectoryBloodHoundSMBWebPythonRDPLDAPKerberosBrute ForceKeePass/KDBX
WRITE-UP ↗
0093

Reset

THMMACHINENONEHARD
Active DirectoryBloodHoundSMBKerberosWebPythonIDOR
WRITE-UP ↗
0092

K2

THMMACHINENONEHARD
WindowsWebActive DirectoryBloodHoundSMBKerberosPrivilege EscalationXSSPythonSSHDatabaseDockerSudoSQL InjectionWinRMNTLMPassword CrackingWAF
WRITE-UP ↗
0091

Extract

THMMACHINENONEHARD
WebPythonReverse ShellCVEPHPAPISSRFGopherNext.jsCVE-2025-29927
WRITE-UP ↗
0090

El Bandito

THMMACHINENONEHARD
WebPythonJavaScriptJSONSSRFAPI
WRITE-UP ↗
0089

Forward

THMMACHINENONEMEDIUM
Active DirectoryBloodHoundSMBWebPythonRDPDockerSudoCTFKerberosWinRMWindowsPrivilege Escalation
WRITE-UP ↗
0088

Attacktive Directory

THMMACHINENONEMEDIUM
Active DirectorySMBKerberosWebPythonPassword CrackingPort ScanningAS-REP RoastingDCSyncNTDS.DITPass the HashWinRM
WRITE-UP ↗
0087

Interception

THMMACHINENONEMEDIUM
WebPythonReverse ShellCredential CapturePHPAPIJSONSSRFCommand InjectionOTP BypassRate Limit Bypass
WRITE-UP ↗
0086

Windows Jump

THMMACHINENONEMEDIUM
WindowsSMBWebReverse ShellCredential CaptureService AbuseScheduled Task AbusePowerShell
WRITE-UP ↗
0085

Recruit

THMMACHINENONEMEDIUM
WebReverse ShellPHPAPISQL InjectionFile InclusionLFIRCE
WRITE-UP ↗
0084

Silent Monitor

THMMACHINENONEMEDIUM
WebPythonSSHDatabaseCommand InjectionSQL InjectionSSRFIDOR
WRITE-UP ↗
0083

Infinity Pool

THMMACHINENONEMEDIUM
WebReverse ShellSSHAPISSRFSQL Injection
WRITE-UP ↗
0082

The Guest Book

THMMACHINENONEMEDIUM
WebPrompt InjectionCommand Execution
WRITE-UP ↗
0081

The Hollow Shell

THMMACHINENONEMEDIUM
WebPythonFile UploadPHPJSONZip Slip
WRITE-UP ↗
0080

Blog

THMMACHINENONEMEDIUM
WebWordPressAPIBrute ForceRCE
WRITE-UP ↗
0079

Fools Mate Revenge

THMMACHINENONEMEDIUM
WebAPIPrototype Pollution
WRITE-UP ↗
0078

Wekor

THMMACHINENONEMEDIUM
WebWordPressReverse ShellCTFPHPSQL Injection
WRITE-UP ↗
0077

Dogcat

THMMACHINENONEMEDIUM
WebReverse ShellDockerPHPFile InclusionRCEDocker Escape
WRITE-UP ↗
0076

Relevant

THMMACHINENONEMEDIUM
Web
WRITE-UP ↗
0075

GoldenEye

THMMACHINENONEMEDIUM
WebPythonPrivilege EscalationCTFEnumerationPort ScanningPOP3Brute Force
WRITE-UP ↗
0074

Juicy

THMMACHINENONEMEDIUM
WebXSSJavaScriptJSONAIPrompt InjectionSystem Prompt Leakage
WRITE-UP ↗
0073

Farewell

THMMACHINENONEMEDIUM
WindowsLinuxWebXSSPythonPHPWAFAPI
WRITE-UP ↗
0072

Padelify

THMMACHINENONEMEDIUM
WebXSSPath TraversalPHPWAF
WRITE-UP ↗
0071

Wonderland

THMMACHINENONEMEDIUM
WebPythonSSHSUID/SGIDLinux CapabilitiesSteganographyPython Module HijackingPath Hijacking
WRITE-UP ↗
0070

Sequence

THMMACHINENONEMEDIUM
WebXSSReverse ShellDockerFile UploadPHPSSRFCSRFDocker EscapeAPI
WRITE-UP ↗
0069

Voyage

THMMACHINENONEMEDIUM
LinuxWebPythonReverse ShellSSHCVEInsecure DeserializationPHPLDAPAPIJSONLinux CapabilitiesDocker Escape
WRITE-UP ↗
0068

CAPTCHApocalypse

THMMACHINENONEMEDIUM
WebPythonSudoOCRPHPCAPTCHA
WRITE-UP ↗
0067

Whats Your Name

THMMACHINENONEMEDIUM
WebXSSJavaScriptPHPCSRF
WRITE-UP ↗
0066

Injectics

THMMACHINENONEMEDIUM
WebReverse ShellPHPSQL InjectionSSTISecond-Order SQL InjectionRCE
WRITE-UP ↗
0065

Include

THMMACHINENONEMEDIUM
WebJavaScriptPHPAPISQL InjectionFile InclusionPort ScanningLinux CapabilitiesLog Poisoning
WRITE-UP ↗
0064

Hammer

THMMACHINENONEMEDIUM
LinuxWebPythonReverse ShellSSHPHPJWT
WRITE-UP ↗
0063

Ultra Tech

THMMACHINENONEMEDIUM
LinuxWebSSHDatabaseDockerSudoAPIEnumerationSQL Injection
WRITE-UP ↗
0062

Rabbit Store

THMMACHINENONEMEDIUM
WebXSSWeb Enumeration
WRITE-UP ↗
0061

Revenge

THMMACHINENONEMEDIUM
WebReverse ShellSSHSudoPassword CrackingEnumerationPort Scanning
WRITE-UP ↗
0060

Net Sec Challenge

THMMACHINENONEMEDIUM
WebSSHNetworkFTPPort ScanningBrute ForceTelnet
WRITE-UP ↗
0059

Mr. Robot

THMMACHINENONEMEDIUM
WebPythonReverse ShellSudoPHPPort ScanningSUID/SGIDWordPress
WRITE-UP ↗
0058

Lookback

THMMACHINENONEEASY
Active DirectoryWebCredential CaptureSubdomain Enumeration
WRITE-UP ↗
0057

Silver Platter

THMMACHINENONEEASY
WebSSHPivotingSudoSQL InjectionIDORBrute Force
WRITE-UP ↗
0056

Cipher's Secret Message

THMMACHINENONEEASY
PythonCryptographyEnumerationCaesar Cipher
WRITE-UP ↗
0055

Lo-Fi

THMMACHINENONEEASY
WebPHPSQL InjectionFile InclusionLFI
WRITE-UP ↗
0054

Light

THMMACHINENONEEASY
SQL InjectionDatabase
WRITE-UP ↗
0053

Fools Mate

THMMACHINENONEEASY
JavaScriptClient-Side Validation Bypass
WRITE-UP ↗
0052

CyberHeroes

THMMACHINENONEEASY
JavaScriptSource Code Analysis
WRITE-UP ↗
0051

W1seGuy

THMMACHINENONEEASY
PythonCryptographyBrute Force
WRITE-UP ↗
0050

Anonforce

THMMACHINENONEEASY
SSHCTFFTPPassword CrackingPGP
WRITE-UP ↗
0049

Checkmate

THMMACHINENONEEASY
WebSSHBrute ForcePassword CrackingSHA-256CuppCrunch
WRITE-UP ↗
0048

Gallery

THMMACHINENONEEASY
XSSReverse ShellSSHPivotingPHPSQL Injection
WRITE-UP ↗
0047

Team

THMMACHINENONEEASY
WebPythonReverse ShellSSHPath TraversalFTPSteganography
WRITE-UP ↗
0046

Tech_Supp0rt-1

THMMACHINENONEEASY
WebWordPressPHPSMBSubrionSUID/SGIDCommand Execution
WRITE-UP ↗
0045

Smart Grotto

THMMACHINENONEEASY
WebReverse ShellWiresharkPHPCron
WRITE-UP ↗
0044

Mustacchio

THMMACHINENONEEASY
WebSSHPassword CrackingXXEPath Hijacking
WRITE-UP ↗
0043

HealthGPT

THMMACHINENONEEASY
AIPrompt Injection
WRITE-UP ↗
0042

BankGPT

THMMACHINENONEEASY
AIPrompt InjectionSystem Prompt Leakage
WRITE-UP ↗
0041

Dig Dug

THMMACHINENONEEASY
DNSDNS Enumeration
WRITE-UP ↗
0040

Archangel

THMMACHINENONEEASY
WebReverse ShellPivotingPHPFile InclusionCronSUID/SGIDLog PoisoningRCEPath Hijacking
WRITE-UP ↗
0039

Corridor

THMMACHINENONEEASY
WebIDORMD5
WRITE-UP ↗
0038

ColddBox - Easy

THMMACHINENONEEASY
WebWordPressReverse ShellSSHPivotingSudoPHPRCEXML-RPC
WRITE-UP ↗
0037

VulnNet - Internal

THMMACHINENONEEASY
SMBWebSSHSSH TunnelingSUID/SGIDRedis
WRITE-UP ↗
0036

Poster

THMMACHINENONEEASY
WebSSHCredential CapturePivoting
WRITE-UP ↗
0035

Agent T

THMMACHINENONEEASY
WebPHPJSONRCEGulpSB Admin 2
WRITE-UP ↗
0034

Neighbour

THMMACHINENONEEASY
WebPHPIDORMD5
WRITE-UP ↗
0033

Source

THMMACHINENONEEASY
WebWebminRCECVE
WRITE-UP ↗
0032

Chocolate Factory

THMMACHINENONEEASY
WebReverse ShellSSHPivotingPrivilege EscalationSudoPHPFTPLXD
WRITE-UP ↗
0031

Easy Peasy

THMMACHINENONEEASY
SSHPassword CrackingPort ScanningCronNginxApacheSteganography
WRITE-UP ↗
0030

Fowsniff CTF

THMMACHINENONEEASY
WebSSHCTFOSINTPOP3Brute Force
WRITE-UP ↗
0029

Lian_Yu

THMMACHINENONEEASY
WebSSHPrivilege EscalationCTFFTPSteganographyBrute Force
WRITE-UP ↗
0028

Year of the Rabbit

THMMACHINENONEEASY
WebSSHCVESudoFTPDNSBrute Force
WRITE-UP ↗
0027

Chill Hack

THMMACHINENONEEASY
WebReverse ShellSSHPivotingDockerSudoCTFPHPFTPSteganography
WRITE-UP ↗
0026

CTF collection Vol. 1

THMMACHINENONEEASY
WebWiresharkNetworkCryptographyCTFQR CodeBrainfuckVigenereHex EditingPacket Analysis
WRITE-UP ↗
0025

Anthem

THMMACHINENONEEASY
WindowsWebPort ScanningRDPUmbraco
WRITE-UP ↗
0024

Wgel CTF

THMMACHINENONEEASY
WebPythonSSHSudoCTF
WRITE-UP ↗
0023

Brute It

THMMACHINENONEEASY
LinuxWebSSHPrivilege EscalationSudoPassword CrackingPort Scanning
WRITE-UP ↗
0022

Ignite

THMMACHINENONEEASY
WebReverse ShellDatabaseSudoPHPPassword CrackingFuel CMSCVERCE
WRITE-UP ↗
0021

GamingServer

THMMACHINENONEEASY
WebSSHSudoPassword CrackingLXD
WRITE-UP ↗
0020

Tomghost

THMMACHINENONEEASY
WebSSHPivotingSudoPassword CrackingTomcatJavaApache
WRITE-UP ↗
0019

Startup

THMMACHINENONEEASY
WebReverse ShellSSHWiresharkFTPFile UploadCron
WRITE-UP ↗
0018

Skynet

THMMACHINENONEEASY
SMBWebReverse ShellSSHCTFPHPFile InclusionPort ScanningWildcard InjectionIMAP
WRITE-UP ↗
0017

Cyborg

THMMACHINENONEEASY
WebReverse ShellSSHSudo
WRITE-UP ↗
0016

LazyAdmin

THMMACHINENONEEASY
LinuxWebPythonReverse ShellInsecure DeserializationPath TraversalSudoCTFPHPRCE
WRITE-UP ↗
0015

Agent Sudo

THMMACHINENONEEASY
WebSSHPrivilege EscalationSudoCTFFTPBrute ForcePassword CrackingEnumerationSteganographyBinwalkCVE
WRITE-UP ↗
0014

Bounty Hacker

THMMACHINENONEEASY
WebSSHSudoFTPBrute ForcePrivilege Escalation
WRITE-UP ↗
0013

Simple CTF

THMMACHINENONEEASY
WebSSHSudoCTFFTPSQL InjectionCVEWeb Enumeration
WRITE-UP ↗
0012

OhSINT

THMMACHINENONEEASY
WebFile UploadMetadataOSINT
WRITE-UP ↗
0011

RootMe

THMMACHINENONEEASY
WebPythonReverse ShellSSHPrivilege EscalationCTFPHPSUID/SGID
WRITE-UP ↗
0010

Basic Pentesting

THMMACHINENONEEASY
LinuxSMBWebSSHCredential CapturePassword CrackingBrute ForceApacheStrutsJava
WRITE-UP ↗
0009

MD2PDF

THMMACHINENONEEASY
SSHSSRFHTML-to-PDF
WRITE-UP ↗
0008

Publisher

THMMACHINENONEEASY
LinuxWebSSHPivotingCTFSUID/SGIDRCE
WRITE-UP ↗
0007

Overpass

THMMACHINENONEEASY
WebReverse ShellSSHCredential CaptureSudoPassword CrackingCron
WRITE-UP ↗
0006

TakeOver

THMMACHINENONEEASY
WebSubdomain EnumerationSubdomain Takeover
WRITE-UP ↗
0005

Brooklyn Nine Nine

THMMACHINENONEEASY
WebSudoFTPSteganographyExifToolBrute Force
WRITE-UP ↗
0004

Res

THMMACHINENONEEASY
Reverse ShellSUID/SGIDRedisCommand Injection
WRITE-UP ↗
0003

Lookup

THMMACHINENONEEASY
WebReverse ShellSSHSudoPHPPassword CrackingSUID/SGIDCommand InjectionFile UploadBrute ForcePath HijackingelFinder
WRITE-UP ↗
0002

Pickle Rick

THMMACHINENONEEASY
LinuxWebReverse ShellSSHSudoPHPInsecure Deserialization
WRITE-UP ↗
0001

Vulnerability Capstone

THMMACHINENONEEASY
Fuel CMSRCECVE
WRITE-UP ↗