RatCTF
🐀🐀🐀 0 pts earned

Container Escape

Premium Machine (Locked)

🧩 ContainmentFailure

🖧 AD Network — ContainmentFailure

🔒 Container Caps 🔒 Container Env 🔒 Container Mount 🔒 Container Socket Container Escape

SYS_ADMIN capability is present. The classic cgroups v1 notify_on_release escape uses the release_agent file to execute a command as root on the host when a cgroup empties. Writes the root flag to /tmp.

🩸 First user blood: 00x003
Part of the ContainmentFailure set — it is not listed on the main challenges page, but its ports are open to you. Connect straight to the target IP and ports below; no pivot needed.
Target IP Premium required
User Flag Pending
Root Flag Pending

Community

Community Hints

Grade A · 1000 pts Grade B · 700 pts Grade C · 400 pts Grade D · 200 pts + 150 credits on accept

Short, stage-specific nudges — directional, spoiler-light, no exact commands.

No community hints yet — be the first to add one!

Community

Community Walkthroughs

Grade A · 2500 pts Grade B · 1750 pts Grade C · 1000 pts Grade D · 500 pts + 300 credits on accept

🔒 Walkthroughs are spoilers — capture the root flag on this machine to unlock them for free.