infraProhard

SecretShell

alfactf

Task: Pentest scenario with web shell, GitLab access, and lateral movement. Solution: Found shell.php via robots.txt, extracted GitLab credentials from .env, abused CI/CD shell runner for RCE, extracted SSH key from bash_history, and moved laterally to production server.

$ ls tags/ techniques/
credential_leakinformation_disclosuregitlabcicd_abusessh_key_extractionlateral_movementweb_shellenv_filepentest
Information disclosure via exposed web shellCredential harvesting from .env fileGitLab CI/CD pipeline abuse for RCESSH private key extractionLateral movement via SSH to production
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups