RatCTF
🐀 0 pts earned

Switchboard Relay

🧩 OperationSwitchboard

🖧 AD Network — OperationSwitchboard

Switchboard FTP Switchboard Relay Switchboard Cache Switchboard Sync Switchboard Monitor

Internal host — not internet-facing. Reach it by pivoting from your sw-ftp foothold (SSH tunnel / proxychains, or the in-browser Pwnbox) at sw-smtp.default.svc.cluster.local on standard ports. A Flask status page leaks the entire process environment as JSON, including an SSH_PASS variable. SMTP VRFY is enabled for user enumeration. Root escalation is a clean sudo zip GTFObins one-liner.

🩸 First user blood: 00x003 🩸 First root blood: teammyinside
Internal machine — reachable only by pivoting from the entry host. It is not directly scannable from the internet, so external scans return filtered. This is by design, not an outage.
Target IP Log in to reveal
User Flag Pending
Root Flag Pending

Community

Community Hints

Grade A · 1000 pts Grade B · 700 pts Grade C · 400 pts Grade D · 200 pts + 150 credits on accept

Short, stage-specific nudges — directional, spoiler-light, no exact commands.

No community hints yet — be the first to add one!

Community

Community Walkthroughs

Grade A · 2500 pts Grade B · 1750 pts Grade C · 1000 pts Grade D · 500 pts + 300 credits on accept

🔒 Community walkthroughs are spoilers — capture the root flag on this machine to unlock them.