Pwnhackcom - Olympus

sudo -l

Output:

(hera) NOPASSWD: /usr/bin/docker
(ALL) NOPASSWD: /usr/bin/systemctl status prometheus.service

Check capabilities:

getcap -r / 2>/dev/null

→ /usr/bin/python3.9 = cap_dac_read_search+ep pwnhackcom olympus

Suppose you find a Struts2 vulnerability. Using curl directly will trigger the WAF. Instead:

Based on aggregated user reports and walkthrough requests, the Olympus tier on PwnHackCom typically involves a series of interconnected machines (a "dungeon" chain). Unlike standard CTFs where flags are independent, Olympus flags often serve as SSH keys or decryption tokens for the next machine. sudo -l

Check crontab:

crontab -l

*/5 * * * * /opt/zeus_guard.sh

Contents of /opt/zeus_guard.sh:

#!/bin/bash
/usr/bin/curl -s http://internal.olympus/health | /bin/bash

Most CTFs offer a standalone Linux box. Olympus, however, deploys a full Windows Server 2022-based Active Directory environment with cross-domain trusts, Group Policy Objects (GPOs) containing subtle misconfigurations, and Kerberoastable service accounts. Attacking Olympus means mastering Rubeus, Mimikatz, and BloodHound in a non-trivial network.