RatLabs
🏛️
Premium Vault
Time-windowed labs that have gone offline are archived here. Premium members can replay every retired machine, anytime — even after the window closes.
Also includes premium machines, walkthroughs, and tips.
A preview of the machines waiting for you.
Offline — window closed
The database administrator forgot the most important rule: always set a root password. Tap into the exposed data store, recover what was left in plaintext, and pivot your way to full control.
Offline — window closed
A Redis instance stands wide open — no authentication, no firewall, just raw access to an in-memory data store. The question isn't whether you can read it. The question is: can you turn a cache into a root shell?
Offline — window closed
Two file-sharing services, two attack surfaces. Pivot between SMB and FTP to piece together the credentials that bridge your path to root. Neither service alone holds the answer — the key is in the crossing.
Offline — window closed
A network management agent leaks far more than just metrics. Walk the MIB tree, read what the community string reveals, and follow the trail of exposed data straight to a root prompt.