Break In If You Can
Three chained October RCEs. One 0.5 ETH prize. Break in if you can.
Wallet prize: 0.5 ETHDetails
The key to a real Ethereum wallet containing 0.5 ETH is hidden on the PHP box. The first person to find it may take the entire balance.
Funds are outside the operator’s control once moved. There is no site claim, manual payment, or operator eligibility, sanctions, or tax check before transfer. Participation eligibility and prohibited conduct still apply. Submitting a pivot-php flag records your progress; it does not award the wallet.
Public wallet: 0x11f316829363CCD477B9c5122ed86bEcB31E2c77 · View balance and transactions on Etherscan.
Not marked as taken by the operator. Check Etherscan for the balance. This status is updated manually and may be cached for up to 90 seconds; it is not a live balance.
Abstract
The pivot lab is a three-stage SSH pivot, Node → Ruby → PHP. Exploit the Node application first to establish a foothold. The Ruby and PHP applications are on an internal network. Use the SSH keys you recover to pivot deeper, executing commands on the next target (e.g., ssh ruby '<cmd>') as an unprivileged guest. Exploit each stage's application to execute code as its application user to reach the flag and continue. The chain is yours alone.
- Stage 1Node.js Flag
- Stage 2Ruby Flag
- Stage 3PHP Flag
Every stage reproduces a real vulnerability disclosed in October 2026, not an invented one:
| Stage | Target | Vulnerability | CVE |
|---|---|---|---|
| 1 | Node.js | Brotli decoder out-of-bounds write (RCE) | CVE-2026-111497 |
| 2 | Ruby | Onigmo regex compiler integer overflow (RCE) | CVE-2026-110264 |
| 3 | PHP | Request-lifecycle memory-safety flaws (RCE) | CVE-2026-109618, CVE-2026-109619 |
CVE-2026-110264 is assigned to GitLab; the underlying flaw is in Ruby's bundled Onigmo engine, patched in Ruby 4.0.9 / 3.4.12 / 3.3.13.
Read the prize terms. Flags and points have no monetary value.
Rules
Each target runs in isolation from the platform, with no internet access. Attack the targets, not the platform.
No denial-of-service, flooding, or high-volume scanning. Keep your attacks strictly to the application logic.
Crashing a target while exploiting its bug is allowed. If a box stops, use Open target in /play to recreate it; it does not restart automatically.
Labs stop after 15 idle minutes and last at most 2 hours; solves are kept.
System Architecture Overview
How this practice environment is built, isolated, and recovered.
Learn from successful runs
Detailed logs of successful runs—including the timeline, commands, and shareable output of each run—are planned for publication so others can learn how each stage was solved.
Public run logs are not available yet. The publication timing, attribution, and redaction rules will be stated before publication begins. See the privacy notice.
Play
Progress is tied to this browser cookie unless GitHub is linked. AWS WAF uses a silent JavaScript browser challenge when you join or start a lab.
- Start
- No sign-up needed: simply pick a nickname and play. Link GitHub later if you want to keep your progress across devices.