HackIndex.io
Language
6 research articles
7 blog posts
53 writeups
Exploit WordPress on a subdomain to gain RCE, leverage DNS zone transfer for recon, and abuse sudoers misconfiguration for root escalation.
SQL injection on a web app leads to credential extraction, enabling SSH access. Privilege escalation via misconfigured Linux permissions yields root.
Linear programming attack on a custom XOR-based encryption scheme to recover the flag by solving constraints derived from the cipher's operations.
Exploit a Linux machine by abusing misconfigured services and weak credentials to gain initial access, then escalate privileges through vulnerable SUID binaries.
Memory forensics challenge using Volatility to analyze a Linux memory dump, extracting artifacts to uncover hidden flags through process and file analysis.
Exploit a Windows machine by chaining LDAP enumeration, Kerberoasting, and ACL abuse to escalate privileges and capture the flag.
Exploit a web app leaking user cohort data to enumerate valid credentials, then leverage misconfigured SSH access to escalate privileges on this easy Linux box.
Exploit a plant photography web app via SQLi to extract creds, abuse Shoot! tool for RCE, pivot through user flags, and escalate via SUID binary.
Exploit a Flask SSTI vulnerability in a developer hub app to gain RCE, then escalate privileges via misconfigured sudo or SUID binaries on Linux.
Exploit MongoDB misconfiguration with unauthenticated access to enumerate databases and retrieve credentials, ultimately gaining root on an easy Linux box.
Windows medium box involving checkpoint security mechanisms, requiring careful enumeration, privilege escalation, and bypassing security controls to gain root access.
Exploiting a cloud misconfiguration in a hard Linux HackTheBox machine involving AWS/cloud enumeration, privilege escalation through misconfigured services.
Unauthenticated Next.js RCE via React2Shell (CVE-2025-55182), crack a reused hash from the app SQLite database for SSH, then abuse a root Node --inspect debug port for root.
Insane Windows box exploiting a ping command injection vulnerability, chaining SSRF and lateral movement techniques to achieve full system compromise.
Windows medium box involving log analysis and exploitation of logging mechanisms to gain foothold and escalate privileges through misconfigured services.
Exploit SUID binary and bypass AppArmor restrictions to escalate privileges on a Linux machine through careful enumeration and profile analysis.
Easy Windows box involving LDAP enumeration, custom binary reverse engineering to extract credentials, and Kerberos resource-based constrained delegation abuse for SYSTEM.
Exploiting JWT algorithm confusion and SSTI vulnerabilities on a Linux machine to escalate privileges and capture the flag.
PHP type juggling vulnerability exploited via loose comparison to bypass authentication and gain RCE through crafted input manipulation on a Linux web challenge.
Salt-stack CVE-2020-11651 exploitation on Linux target to achieve unauthenticated RCE as root via the SaltStack master service.
Boot2root Linux box exploiting Webmin vulnerability for initial foothold, then leveraging SUID binary or misconfigurations for root privilege escalation.
Exploiting an outdated WordPress installation on a Linux box via SSH enumeration, privilege escalation through a writable bash history and SUID binaries.
Exploit WordPress plugins for RCE, escalate via sudo misconfiguration and SUID binaries on this Linux box to capture both flags.
Linux box exploiting web app for RCE via PHP, pivoting through user enumeration and sudo misconfiguration for root privilege escalation.
Exploited Exhibitor ZooKeeper RCE to gain foothold, then leveraged password reuse via sudo `password` binary to escalate to root.
Exploiting Nagios XI via authenticated RCE CVE-2019-15949, then escalating privileges using sudo rights to gain root on Linux.
Compromise a Linux machine via LFI to log poisoning through SSH, escalate using MySQL running as root to write a SUID shell.
Linux box rooted via SQLi authentication bypass in Subrion CMS, exploiting a file upload vulnerability to gain RCE, then leveraging a cronjob for privilege escalation.
Boot2root Linux box exploiting weak credentials via FTP enumeration, then escalating privileges using a SUID gdb binary to achieve root access.
SQL injection reveals creds, port knocking opens SSH, password spraying via knockd leads to root through sudo abuse on a Linux target.
Exploit WordPress via user enumeration, brute-force creds, upload PHP reverse shell, then escalate privileges using a writable passwd file.
Easy Linux box exploiting Grav CMS with CVE-2021-21425 for RCE, then leveraging a SUID `php7.4` binary for privilege escalation to root.
Exploit information disclosure on a Linux web challenge by enumerating exposed endpoints to uncover hidden facts and capture the flag.
Exploited Redis and Lua sandbox escape for RCE, then leveraged a SUID binary vulnerability to escalate privileges to root on this Linux machine.
Exploit WordPress plugin vulnerability on a hidden subdomain, escalate via writable Docker-related files to root on this Easy Linux box.
Exploit Flask debug RCE on port 5000, enumerate SMB-like file API, upload reverse shell, then abuse writable /etc/passwd for root escalation.
Exploiting a Windows machine via exposed data in a web app, leveraging SQL injection and weak credentials to gain a foothold and escalate privileges.
Exploit an invite code API flaw to register, abuse command injection in VPN generation, then leverage CVE-2023-0386 OverlayFS for root escalation.
Exploit a Node.js app with SSTI in Handlebars and privilege escalation via a misconfigured SUID binary on an Easy Linux HackTheBox machine.
Exploit a Pterodactyl game panel via subdomain enumeration, command injection, and privilege escalation to root on this medium Linux box.
Reverse engineer a custom bytecode interpreter binary, analyze its instruction set, and craft malicious bytecode to achieve RCE on a Linux target.
Express.js app vulnerable to prototype pollution via query parameters, leading to RCE through crafted payloads to bypass filters and gain a shell.
Exploit a vulnerable web app on a Windows box by discovering hidden endpoints, leveraging SQL injection, and escalating privileges to root via misconfigured services.
Linux box exploiting Overleaf-based file upload vulnerability to gain RCE, then leveraging a misconfigured sudo privilege for root escalation.
Simple Linux box exploiting a unit converter web app with SSRF to access internal services, leading to credential discovery and privilege escalation.
Exploit a second-stage code execution challenge on Linux by analyzing decompiled logic, crafting input to bypass checks, and achieving shell access.
IDOR vulnerability exposes PCAP file containing FTP credentials. Lateral movement via SSH, then privilege escalation using Python's cap_setuid capability.
SQL injection in Cacti leads to RCE, followed by port forwarding and privilege escalation techniques to fully compromise this Windows machine.
We use cookies to improve your browsing experience, analyze site traffic, and personalize content. By clicking "Accept All", you consent to our use of cookies. Privacy Policy.
