Relay

☆ ☆ ☆ ☆ ☆ (0)

pivoting, enumeration Easy

Relay is a beginner-friendly pivot box: ten user accounts, ten flags, one flag per user. You are handed the first account — SSH in directly as relay01 with password R3lay_St4rt_01 (no exploit needed to land the first user), grab the flag, and find the clue each user leaves behind for the next. Walk the chain relay01 → relay02 → … → relay10. NOTE: there is NO root on this machine and no privilege-escalation path. The whole challenge is lateral movement between users — do not waste time hunting for root.

Points: Low 10, Medium 20, High 40, Critical 80

Scope

Static target (always on):
66.228.61.73:30790  (SSH)

Out of Scope

The RatCTF portal (ratctf.com) itself, the Kubernetes cluster and node infrastructure, other players' instances, denial-of-service, and social-engineering or physical attacks.

Rules of Engagement

Authorized practice testing only. Attack only your own assigned instance of this machine. Do not attack the RatCTF portal, shared cluster infrastructure, other players, or run denial-of-service. Find the user and root flags; write up your path. Hosted by The XSS Rat / RatCTF.

Report