HackIndex.io
Language
94 writeups
Intermediate Linux box where a null-auth SMB share and the Cassandra Web directory traversal (EDB-49362) leak a FreeSWITCH event socket password and a reused credential, chained into FreeSWITCH command execution (EDB-47799) and SSH, then a sudo rule that reruns Cassandra Web as root leads to an SSH key and root.
Intermediate Linux box exploiting CVE-2022-35914 in an exposed htmLawed test page for a www-data shell, then escalating to root via a writable cron script.
Intermediate Linux box fronting TeamCity behind an nginx vhost, exploited via the CVE-2024-27198 authentication bypass, then a cracked SSH key and a chain of mail-leaked credentials across three users ends in a sudo pager escape (CVE-2023-26604) for root.
Intermediate Linux box where a Rails mass assignment flaw bypasses email confirmation, a file manager's local file inclusion plants an SSH key for a foothold, and a root private key left in a user's home directory gives privilege escalation.
Intermediate Linux box where an exposed .git history leaks database credentials used to reset SOPlanning's admin hash, unlocking CVE-2024-27114 for a shell, then a leaky cron job and a writable sudo script give root.
Intermediate Windows box where a guessed Sonatype Nexus Repository Manager login leads to an authenticated remote code execution exploit, and the unpatched SMBGhost (CVE-2020-0796) SMBv3 kernel exploit then escalates to SYSTEM.
Intermediate Windows box where anonymous FTP enumeration and a brute-forced default admin password expose a cracked web credential, used to trigger an uploaded PHP reverse shell; a public Task Scheduler privilege escalation exploit then creates a local administrator account.
Easy Windows box where SmarterMail build 6919 on a non-standard port is hit directly with a public remote code execution exploit for an immediate SYSTEM shell, with no further privilege escalation required.
Intermediate Linux box chaining a Responsive Filemanager path traversal to leak OpenEMR's database credentials, cracking the dumped admin bcrypt hash for an authenticated OpenEMR RCE, then reusing the database password to escalate to root.
Intermediate Windows box running XAMPP, where a LibreOffice macro embedded in an uploaded ODT file gives a shell, a PHP webshell dropped into the Apache web root lands execution as the Apache service account, and GodPotato abuses its SeImpersonatePrivilege for a SYSTEM shell.
Intermediate Linux box exposing its .git directory, leaking BoxBilling database credentials used to log into the admin panel, then exploited via the CVE-2022-3552 Twig SSTI for a shell, and escalated to root through a passwordless sudo rule.
Intermediate Windows box where an unauthenticated directory traversal in Argus Surveillance DVR leaks an SSH private key for initial access, then the same traversal exposes a custom-encoded Administrator password that is decoded and reused via runas for an Administrator shell.
Hard Windows box where a malicious ODT upload leaks a NetNTLM hash that cracks to valid credentials, exposing a writable SMB share mapped to the web root for a PHP shell; a passwordless local MySQL running as SYSTEM then writes a DLL into System32 for a WerTrigger DLL-hijack SYSTEM shell.
Intermediate Linux box where a world-browsable admin logs directory leaks a user's password, and a SUID Serv-U FTP Server binary gives a known local privilege escalation straight to root.
Hard Linux box where a default-credential FTP brute force yields a PCAP that reveals a hidden upload endpoint, exploited via the ExifTool CVE-2021-22204 RCE, then escalated to root with PwnKit (CVE-2021-4034).
Intermediate Linux box using Grafana's CVE-2021-43798 directory traversal to leak and decrypt a Prometheus data source password for SSH access, then abusing disk group membership to read root's SSH key off the raw block device.
Hard Linux box where a bookstore author's name doubles as the Weblate admin password, unlocking a Mercurial command injection for a shell, then a sudo-permitted git checkout script hijacked with a post-checkout hook gives root.
Intermediate Linux box where File Browser's default credentials and an enabled shell feature give command execution, an uploaded SSH key gives a foothold as david, and a SUID aa-exec binary gives root through GTFOBins.
Intermediate Linux box running Jorani v1.0.0, exploited via the unauthenticated CVE-2023-26469 log-poisoning RCE for a user shell, then escalated to root through a passwordless sudo rule on env.
Intermediate Windows box where an unauthenticated H2 database console gives remote code execution through a JNI DLL write, and SeImpersonatePrivilege is escalated to SYSTEM with GodPotato.
Easy Windows box, an unpatched Windows Server 2008 SP1 host flagged by nmap's SMB vulnerability scripts and taken with the MS09-050 SMBv2 negotiate function index overflow (CVE-2009-3103) for a direct, unauthenticated SYSTEM shell.
Easy Windows box, an unpatched Windows Server 2008 SP1 host where the MS09-050 SMBv2 negotiate function index overflow (CVE-2009-3103) gives an unauthenticated SYSTEM shell in a single step.
Intermediate Linux box where a Spring Boot API leaks every user's password in plaintext for SSH access, then escalated to root by pushing a malicious script into a git repo a root cron job pulls and executes.
Intermediate Linux box exploiting CVE-2023-34152, an ImageMagick filename command injection, for a www-data shell, then escalating to root through a SUID strace binary.
Intermediate Windows box where a password leaked in an employee page's role field unlocks IMAP mail, a LibreOffice macro phishing email delivered over SMTP gives a user shell, and a writable VeyonService binary escalates to SYSTEM.
Intermediate Linux box where a Werkzeug API's /verify endpoint evaluates raw Python for a shell as cmeeks, then a writable systemd service file combined with a passwordless sudo reboot rule respawns that shell as root.
Intermediate Windows box where a GlassFish directory traversal leaks SynaMan SMTP credentials reused for RDP access, then a TotalAV antivirus quarantine bypass using a directory junction plants a malicious DLL for a SYSTEM shell.
Intermediate Linux box using Openfire's CVE-2023-32315 path traversal to create an unauthenticated admin account, uploading a malicious plugin for code execution, then reusing SMTP credentials from the embedded database log to escalate to root.
Easy Windows box where default admin:admin credentials expose HP Power Manager 4.2, and its pre-auth buffer overflow (CVE-2009-2685) gives a SYSTEM shell directly.
Intermediate Linux box running Laravel 8.4.0 with open registration, exploited by enabling debug mode and firing the CVE-2021-3129 Ignition log-poisoning RCE for a www-data shell, then escalated through a cron-executed artisan file and a scoped sudo Composer rule to root.
Intermediate Linux box exploiting a public LimeSurvey plugin RCE on a hidden vhost with default credentials, then chaining a leaked config password and a symlink-abused sudo rule to reach a second, fully privileged account.
Intermediate Linux box chaining a rogue-MySQL config leak and cracked admin hash into MantisBT's dot_tool command injection for a shell, then escalating to root via a cron-leaked database password reused on a sudo-ALL account.
Intermediate Windows box where a guessable password-reset reminder on a Rails quiz app leads to a SQL injection file write RCE, and insecure folder permissions in BarracudaDrive 6.5 escalate to SYSTEM.
Easy Windows box where an unauthenticated Remote Mouse 3.008 RCE gives a user shell, a base64-encoded saved FileZilla password gives RDP access, and a Remote Mouse file-dialog trick (CVE-2021-35448) escalates to Administrator.
Easy Windows box where a hint-guessed CMS admin password leaks database hashes, and cracking a user's hash leads to RDP access, then a writable XAMPP config hijack (CVE-2020-11107) escalates to Administrator.
Intermediate Linux box where default PostgreSQL credentials and COPY FROM PROGRAM give a postgres shell, then a SUID find binary escalates to root.
Intermediate Windows box where a custom API leaks a base64-encoded password through a process listing, and a cracked PDF reveals a SYSTEM-level command endpoint used to add the account to Administrators.
Intermediate Linux box running WordPress with the vulnerable Simple File List plugin, exploited via its arbitrary file upload bug (EDB-48979) for a shell, then escalated to root using a reused database password for SSH and a SUID dosbox binary that mounts the filesystem.
Intermediate Linux box exploiting CVE-2023-27163, an unauthenticated command injection in Maltrail's login endpoint, then escalating to root through a world-writable backup script run by cron.
Hard Windows box exploited through a custom FTP server's format-string info leak and a DEP-bypassing ROP chain for a buffer overflow shell, then escalated by abusing SeDebugPrivilege to impersonate winlogon and create a local administrator.
Intermediate Linux box running an outdated CS-Cart 1.3.3 store with a classes_dir local file inclusion that leaks /etc/passwd, leading to a guessable SSH password and an unrestricted sudo rule straight to root.
Intermediate Linux box where a browser-based ttyd terminal gives a low-privileged shell, then CVE-2022-35411, an insecure pickle deserialization in a local rpc.py service running as root, gives immediate root.
Intermediate Linux box where Ident protocol enumeration leaks a username that doubles as its own SSH password, landing in a restricted shell that's escaped via the ed editor, and docker group membership alone is enough to mount the host filesystem and root the box.
Intermediate Linux box running PluXML 5.8.7 with default admin credentials, exploited through the CVE-2022-25018 static-page PHP injection for a www-data shell, then escalated to root via a plaintext password left in local mail.
Hard Linux mail server where a staff page and SMTP VRFY build a username list, a lazy POP3 password leaks an internal email that sets up a believable SMTP phishing attack against the sales manager, and his filter group membership plus a sudo mail rule lead to root.
Intermediate Linux box running FlatPress with default admin credentials, exploited via the CVE-2022-40048 upload RCE for a www-data shell, then escalated to root through a passwordless sudo rule on apt-get.
Intermediate Linux box where a disclosed web page leaks FTP credentials and an SSH private key, a sudo rule on a messenger script allows command injection as another user, and docker group membership gives root via a host filesystem mount.
Intermediate Linux box where a public backup archive leaks an SSH key restricted by a forced command, bypassed via legacy SCP for a shell as max, then escalated to root through a SUID start-stop-daemon binary.
Intermediate Linux box running Simple PHP Photo Gallery 0.7, exploited via remote file inclusion for a www-data shell, then escalated to root through a base64-encoded MySQL password reused for SSH and PwnKit (CVE-2021-4034).
Intermediate Windows box exploited through a remote file inclusion that downloads and runs a reverse shell under XAMPP, then escalated by swapping a scheduled job's writable executable for a payload that returns a shell as Administrator.
Intermediate Linux box running SeaCMS behind a randomized admin slug, where FTP logs leak both the slug and an LFI or SQLi path to the same SSH credential, then a cron job that blindly swaps binaries in /bin combined with a sudo NOPASSWD rule plants a SUID shell as root.
Intermediate Windows box where an anonymous SMB share leaks a WordPress password, used through the Theme Editor for a reverse shell, then an AlwaysInstallElevated misconfiguration escalates to SYSTEM via a malicious MSI.
Intermediate Linux box running Gitea 1.7.5 with open registration, exploited via the CVE-2019-11229 Git hook RCE to plant an SSH key, then escalated to root through a writable /usr/local/bin ahead of the cron PATH.
Easy Windows box where an X-Forwarded-For header bypasses an IP allowlist to reach a UNION-based SQL injection, leaking a user's password, then a Windows Sticky Notes database exposes the Administrator's password in plain text.
Intermediate Linux box where a WordPress plugin LFI leaks a Redis password used to plant a webshell for a shell as alice, then escalated to root through a tar wildcard injection in a cron job.
Intermediate Linux box running rConfig 3.9.4, chaining an unauthenticated SQL injection with a cracked admin hash and an authenticated RCE for a shell, then escalated to root through a SUID find binary.
Intermediate Linux box where a default admin login exposes an unauthenticated secrets endpoint leaking FTP credentials, used to drop a webshell onto the web root, with a reused database password for SSH and a writable systemd unit for root.
Intermediate Linux box where an exposed phpinfo.php leaks an SPX profiler key, exploited via CVE-2024-42007 to read Tiny File Manager's bcrypt hashes, then password reuse and a sudo make install rule for root.
Easy Windows box where an open Squid proxy exposes a loopback-only phpMyAdmin with default credentials, used to write a webshell via INTO OUTFILE, then a recovered SeImpersonatePrivilege and PrintSpoofer escalate to SYSTEM.
Intermediate Linux box where anonymous FTP write access and an unauthenticated Redis instance combine for code execution via Redis MODULE LOAD, then a shared-object hijack of a root cron job's LD_LIBRARY_PATH for root.
Intermediate Linux box where a SQL injection bypasses a Prison Management System login for an upload-filter bypass RCE, then a reused database password and a tunneled Jenkins CVE chain for root.
Intermediate Linux box where an unsanitized upload filename gives arbitrary file read, leaking a crackable SQLite password hash for SSH, then a sudo wildcard and the happy-dom CVE-2024-51757 code injection for root.
Intermediate Linux box running WordPress with the vulnerable wp-advanced-search plugin, exploited via CVE-2024-9796 unauthenticated SQLi to crack a password hash, then a reused database password for SSH, and a SUID binary's shared library dlopen hijack via a world-writable home directory for root.
Intermediate Linux box where an X-Forwarded-For header bypasses an internal API's IP restriction for an LFI and command injection chain, then a SUID wget overwrite of /etc/passwd for root.
Intermediate Linux box running an outdated Zenphoto gallery with a public RCE exploit for a www-data shell, escalated to root through a CVE-2010-3904 kernel exploit in the RDS protocol.
Hard Linux box chaining a file upload with an LFI via the zip:// wrapper for a www-data shell, then abusing a 7z wildcard in a root cron job to leak a secret that doubles as the root password.
Easy Linux box running a vulnerable Drupal 7 site, exploited with Drupalgeddon2 (CVE-2018-7600) for a www-data shell, then escalated to root through a SUID find binary using a GTFOBins technique.
Easy Linux box running CodoForum v5.1 with default admin credentials, exploited via the CVE-2022-31854 authenticated file-upload RCE for a www-data shell, then escalated to root by reusing database credentials found in the web config.
Easy Linux box running an unauthenticated changedetection.io v0.45.1, exploited through a Jinja2 server-side template injection in the notification body (CVE-2024-32651). The application runs as root, so the SSTI yields a direct root shell with no privilege escalation.
Easy Linux box with a local file inclusion that leaks an SSH private key, cracked for SSH access as mowree, then escalated to root through a world-writable /etc/passwd by adding a second UID 0 account.
Easy Linux box running Apache APISIX 2.8, exploited with CVE-2022-24112 for a low-privileged shell, then escalated to root through an APT Update Pre-Invoke hook in a writable apt.conf.d run by a root cron job.
Easy Linux box with a book store web app vulnerable to SQL injection and default admin credentials, used to upload a PHP reverse shell for a www-data shell. A password file gives SSH access as tony, whose sudo rights include GTFOBins-exploitable binaries like pkexec for root.
Easy Linux box with an anonymous FTP server holding a password-protected zip, cracked to recover an SSH key for tom. After escaping a restricted rbash shell, a MySQL history file leaks tom's password, and unrestricted sudo gives root.
Easy Linux box where the repeated hostname hints at the username geisha, whose SSH password is brute forced. A SUID base32 binary reads root's SSH private key, giving a root login.
Easy Linux box with an injectable GraphQL searchTerm over SQLite, used to dump and crack user hashes for SSH access as jane. A sudo-runnable pass-gen binary writes to /etc/shadow without stripping newlines, so a newline injection adds an account that reaches the shadow group and cracks the root hash.
Easy Linux box where default Nextcloud credentials expose the Issue Tracker source, revealing a SQL injection. A phpinfo page shows the server runs as root from /srv/http, so an INTO OUTFILE webshell gives code execution as root with no privilege escalation.
Easy Linux box chaining a User-Agent-gated local file inclusion with a writable anonymous FTP directory to upload and include a PHP webshell for RCE, then abusing a custom SUID binary's relative whoami call with a PATH hijack for root.
Easy Linux box running FuguHub 8.1, exploited via CVE-2023-24078 by claiming admin through the config wizard and uploading a Lua Server Pages reverse shell. FuguHub runs as root, so the shell lands as root directly with no privilege escalation.
Easy Linux box where directory brute forcing reveals a WordPress user togie, whose weak SSH password is recovered by brute force. The account is in the sudo group, so sudo su gives root.
Easy Linux box where an mPDF HTML-to-PDF converter leaks a config file through its annotation file-read, giving SSH credentials. A localhost Webmin 1.996 is then exploited with its authenticated RCE (CVE-2022-36446), which runs as root, for a root shell.
Easy Linux box running Gerapy v0.9.7 with default admin credentials, exploited via the CVE-2021-32849 authenticated RCE for a shell as app, then escalated to root through a python3.10 binary carrying the cap_setuid capability.
Easy Linux box running ZoneMinder v1.29.0, exploited through a SQL injection in the limit parameter. The database runs as root, so sqlmap's os-shell injects a UDF and executes commands as root directly, with no separate privilege escalation.
Easy Linux box running pyLoad 0.5.0 on port 9666, exploited through the CVE-2023-0297 pre-authentication remote code execution. pyLoad runs as root, so the exploit lands a root shell directly with no privilege escalation.
Easy Linux box running a Ruby HTML-to-PDF app that uses the vulnerable PDFKit gem, exploited via CVE-2022-25765 command injection for a shell as andrew, then escalated to root through a NOPASSWD sudo rule on a writable Ruby script.
Easy Linux box leaking an SSH key and a custom password list that brute forces the seppuku account into a restricted shell. A root-owned password file is reused for samurai, whose sudo rule runs a missing binary in tanto's home, which is planted via the leaked key and run as samurai for root.
Easy Linux box running the backdoored UnrealIRCd 3.2.8.1, exploited via CVE-2010-2075 for a shell as the server user, then escalated to root through a trivially weak root password.
Easy Linux box running the vulnerable WordPress social-warfare plugin v3.5.2, exploited via CVE-2019-9978 for a www-data shell, then escalated to root by reusing the wp-config database password for the takis account, which has unrestricted sudo.
Easy Linux box leaking a username in an HTML comment and a base64-encoded password in robots.txt, used to SSH in as itsskv, then escalating to root with the overlayfs kernel exploit on an outdated 3.13 kernel.
Easy Linux box running SuiteCRM with default admin credentials, exploited via CVE-2022-23940 for a www-data shell, then escalated to root through a sudo-allowed service binary with a GTFOBins path trick.
Intermediate Linux box exploiting a UNION-based SQL injection to dump credentials, reused against the Cockpit panel on port 9090 for a shell as james, then abusing a wildcard cp bug in a custom SUID binary to copy a setuid bash and gain root.
Easy Linux box with a RaspAP panel behind basic auth. Default credentials and the CVE-2020-24572 command injection give a www-data shell, then a writable Python script runnable as root via sudo escalates to root.
Intermediate Linux box exposing an unauthenticated LocalStack S3 bucket with plaintext credentials in users.json, used to SSH in as brian, then escalating to root by abusing an LD_PRELOAD-preserving sudo rule with a malicious shared object.
Intermediate Linux box exploiting Atlassian Confluence CVE-2022-26134 OGNL injection for remote code execution as the confluence user, then overwriting a root-run backup script in /opt to set SUID on bash for a root shell.
Easy Linux box exploiting a Sendmail clamav-milter remote command execution vulnerability. SNMP leaks the black-hole-mode milter process, and a public Perl exploit injects an inetd bind shell for a root shell with no privilege escalation needed.
We use cookies to improve your browsing experience, analyze site traffic, and personalize content. By clicking "Accept All", you consent to our use of cookies. Privacy Policy.
