GlassHeap - PHP2Shell 2 Lab

Analyze the disk artifacts, container configuration files, runtime security logs, memory dumps, and Windows event logs to reconstruct the full attack chain -- from the initial PHP zero-day exploitation through container escape, credential harvesting, and domain-wide credential extraction via DCSync.

Category:

Endpoint Forensics

Tactics:

Initial Access Execution Persistence Privilege Escalation Credential Access Discovery Lateral Movement Command and Control

Tools:

Timeline Explorer hayabusa EvtxECmd Volatility 3

hard

2hrs

Sign in to Download Lab Files

Unlock Your Full Learning Experience with CyberRange Labs

Sign up to track your progress, unlock exclusive labs, and showcase your achievements—begin your journey now!