A walkthrough of the Slort machine from OffSec Proving Grounds Play, demonstrating a two-stage attack chain on a Windows target. The initial foothold exploits PHP's allow_url_include directive enabled on an old XAMPP installation: the ?page= GET parameter is passed unsanitised into include(), allowing a remote URL to be fetched and executed as server-side PHP, yielding a Meterpreter shell as a low-privilege user. Privilege escalation is achieved by discovering C:\Backup\TFTP.EXE — a binary invoked every five minutes by a scheduled task running as Administrator — has full write permissions for BUILTIN\Users. Replacing the binary with a Meterpreter payload and waiting for the scheduler delivers an Administrator session. The writeup covers full reconnaissance, web enumeration with ffuf, LFI/RFI confirmation, post-exploitation enumeration, and detailed mitigations for all three critical vulnerabilities.
