PowerShell Remoting over SSH — PSModulePath Privilege Escalation

Start the Docker container locally:

docker run -d --rm --name green7 -p 2222:22 -p 8080:80 joshbeck2024/ctf-powershell-flag-green-7:latest

Note: You can either keep reading the walkthrough here, or you can go to:

• http://localhost:8080 for a full walkthrough as well.
  • (On your Kali Linux machine once the container has started)

Username/Password: ctfplayer:ctfplayer ·

Goal: read /c/flag/flag.txt (root-only)

📌 About the environment — This host runs Linux, but your only access is a PowerShell environment: SSH hands your session straight to pwsh (there is no Bash prompt). You will do everything with PowerShell cmdlets, even though the filesystem, cron, and permissions underneath are all Linux. The flag lives at C:\flag\flag.txt, simulated on Linux as /c/flag/flag.txt, readable only by root.

Prerequisite — check your PowerShell version

SSH-based remoting (Enter-PSSession -HostName …) requires PowerShell 7 or newer. Windows PowerShell 5.1 (the default on Windows) cannot do this — so check first. Open any PowerShell window and run:

$PSVersionTable
# Name                           Value
# ----                           -----
# PSVersion                      7.4.6      <-- must be 7.x or higher
# PSEdition                      Core

⚠️ If PSVersion shows 5.1 (or anything below 7), install the latest PowerShell:

[Install the latest version of PowerShell](https://app.notion.com/p/Install-the-latest-version-of-PowerShell-3f94c8e52376806fa60ac1fd23f399db)

1. Connect via PowerShell Remoting over SSH

From any machine with PowerShell 7+ (pwsh), start an interactive remoting session. Replace <IP> with the target address (add -Port 2222 if the SSH port was mapped).