advanced

Breach: Sentient Systems Healthcare Network

Sentient Systems, a healthcare SaaS provider, stores PHI for 200+ clinics. Intelligence suggests they run a legacy admin panel exposed to the internet and use Active Directory internally. Your objective: breach the perimeter, pivot through their internal network, compromise AD, and exfiltrate the production patient database.

scopeIsolated, authorized simulation. Every organisation, host, account and dataset in this campaign is fictional and synthetic — no real systems, customers or personal data are involved. Only the linked hacking.community labs are in scope.

0 / 5 hosts compromised +950 XP

Each host is a real lab. Open it, solve it, and submit its flag here to compromise the host — that reveals the pivot intel and unlocks the next machine in the chain.

// difficulty curveramp

easymediumhard

Difficulty ramps up — early hosts are gentler, the final boxes are the hardest.

web-dmz-0110.50.10.15easy

External web portal (DMZ)

host 1

Enumerate the public-facing patient portal at 10.50.10.15. A search feature appears vulnerable to SQL injection. Extract database credentials.

graded: the per-user flag (hc{…}) issued by “Classic UNION-based SQL Injection” — A search endpoint glues user input straight into a SQL query. Extract the admin flag from the `secrets` table.
then: unlocks app-prod-12

open Classic UNION-based SQL Injection

app-prod-12

AD-joined application server

host 2

compromise the previous host to unlock

jenkins-app-01

CI/CD pipeline server

host 3

compromise the previous host to unlock

dc01

Primary domain controller

host 4

compromise the previous host to unlock

sql-cluster-10

Production SQL Server (crown jewels)

host 5

compromise the previous host to unlock