# The Husky Hacker

- **URL:** https://hackindex.io/authors/thehuskyhacker
- **Role:** sysadmin
- **Profiles:** https://github.com/TheHuskyHacker, https://www.youtube.com/channel/UCgc1tLxOuE0X9gsoaiYYBpw

> somehow this idiot behind the keyboard got the creds

## Writeups

- [Clue Writeup - Proving Grounds](https://hackindex.io/writeups/clue.md): Intermediate Linux box where a null-auth SMB share and the Cassandra Web directory traversal (EDB-49362) leak a FreeSWITCH event socket password and a reused credential, chained into FreeSWITCH command execution (EDB-47799) and SSH, then a sudo rule that reruns Cassandra Web as root leads to an SSH key and root.
- [Law Writeup - Proving Grounds](https://hackindex.io/writeups/law.md): Intermediate Linux box exploiting CVE-2022-35914 in an exposed htmLawed test page for a www-data shell, then escalating to root via a writable cron script.
- [Scrutiny Writeup - Proving Grounds](https://hackindex.io/writeups/scrutiny.md): Intermediate Linux box fronting TeamCity behind an nginx vhost, exploited via the CVE-2024-27198 authentication bypass, then a cracked SSH key and a chain of mail-leaked credentials across three users ends in a sudo pager escape (CVE-2023-26604) for root.
- [Boolean Writeup - Proving Grounds](https://hackindex.io/writeups/boolean.md): Intermediate Linux box where a Rails mass assignment flaw bypasses email confirmation, a file manager's local file inclusion plants an SSH key for a foothold, and a root private key left in a user's home directory gives privilege escalation.
- [BitForge Writeup - Proving Grounds](https://hackindex.io/writeups/bitforge.md): Intermediate Linux box where an exposed .git history leaks database credentials used to reset SOPlanning's admin hash, unlocking CVE-2024-27114 for a shell, then a leaky cron job and a writable sudo script give root.
- [Billyboss Writeup - Proving Grounds](https://hackindex.io/writeups/billyboss.md): Intermediate Windows box where a guessed Sonatype Nexus Repository Manager login leads to an authenticated remote code execution exploit, and the unpatched SMBGhost (CVE-2020-0796) SMBv3 kernel exploit then escalates to SYSTEM.
- [AuthBy Writeup - Proving Grounds](https://hackindex.io/writeups/authby.md): Intermediate Windows box where anonymous FTP enumeration and a brute-forced default admin password expose a cracked web credential, used to trigger an uploaded PHP reverse shell; a public Task Scheduler privilege escalation exploit then creates a local administrator account.
- [Algernon Writeup - Proving Grounds](https://hackindex.io/writeups/algernon.md): Easy Windows box where SmarterMail build 6919 on a non-standard port is hit directly with a public remote code execution exploit for an immediate SYSTEM shell, with no further privilege escalation required.
- [Apex Writeup - Proving Grounds](https://hackindex.io/writeups/apex.md): Intermediate Linux box chaining a Responsive Filemanager path traversal to leak OpenEMR's database credentials, cracking the dumped admin bcrypt hash for an authenticated OpenEMR RCE, then reusing the database password to escalate to root.
- [Craft Writeup - Proving Grounds](https://hackindex.io/writeups/craft.md): Intermediate Windows box running XAMPP, where a LibreOffice macro embedded in an uploaded ODT file gives a shell, a PHP webshell dropped into the Apache web root lands execution as the Apache service account, and GodPotato abuses its SeImpersonatePrivilege for a SYSTEM shell.
- [BullyBox Writeup - Proving Grounds](https://hackindex.io/writeups/bullybox.md): Intermediate Linux box exposing its .git directory, leaking BoxBilling database credentials used to log into the admin panel, then exploited via the CVE-2022-3552 Twig SSTI for a shell, and escalated to root through a passwordless sudo rule.
- [DVR4 Writeup - Proving Grounds](https://hackindex.io/writeups/dvr4.md): Intermediate Windows box where an unauthenticated directory traversal in Argus Surveillance DVR leaks an SSH private key for initial access, then the same traversal exposes a custom-encoded Administrator password that is decoded and reused via runas for an Administrator shell.
- [Craft2 Writeup - Proving Grounds](https://hackindex.io/writeups/craft2.md): Hard Windows box where a malicious ODT upload leaks a NetNTLM hash that cracks to valid credentials, exposing a writable SMB share mapped to the web root for a PHP shell; a passwordless local MySQL running as SYSTEM then writes a DLL into System32 for a WerTrigger DLL-hijack SYSTEM shell.
- [Election1 Writeup - Proving Grounds](https://hackindex.io/writeups/election1.md): Intermediate Linux box where a world-browsable admin logs directory leaks a user's password, and a SUID Serv-U FTP Server binary gives a known local privilege escalation straight to root.
- [ExGhost Writeup - Proving Grounds](https://hackindex.io/writeups/exghost.md): Hard Linux box where a default-credential FTP brute force yields a PCAP that reveals a hidden upload endpoint, exploited via the ExifTool CVE-2021-22204 RCE, then escalated to root with PwnKit (CVE-2021-4034).
- [Fanatastic Writeup - Proving Grounds](https://hackindex.io/writeups/fanatastic.md): Intermediate Linux box using Grafana's CVE-2021-43798 directory traversal to leak and decrypt a Prometheus data source password for SSH access, then abusing disk group membership to read root's SSH key off the raw block device.
- [Fikklish Writeup - Proving Grounds](https://hackindex.io/writeups/fikklish.md): Hard Linux box where a bookstore author's name doubles as the Weblate admin password, unlocking a Mercurial command injection for a shell, then a sudo-permitted git checkout script hijacked with a post-checkout hook gives root.
- [File-Browser Writeup - Proving Grounds](https://hackindex.io/writeups/file-browser.md): Intermediate Linux box where File Browser's default credentials and an enabled shell feature give command execution, an uploaded SSH key gives a foothold as david, and a SUID aa-exec binary gives root through GTFOBins.
- [Jordak Writeup - Proving Grounds](https://hackindex.io/writeups/jordak.md): Intermediate Linux box running Jorani v1.0.0, exploited via the unauthenticated CVE-2023-26469 log-poisoning RCE for a user shell, then escalated to root through a passwordless sudo rule on env.
- [Jacko Writeup - Proving Grounds](https://hackindex.io/writeups/jacko.md): Intermediate Windows box where an unauthenticated H2 database console gives remote code execution through a JNI DLL write, and SeImpersonatePrivilege is escalated to SYSTEM with GodPotato.
- [Internal-SMB Writeup - Proving Grounds](https://hackindex.io/writeups/internal-smb.md): Easy Windows box, an unpatched Windows Server 2008 SP1 host flagged by nmap's SMB vulnerability scripts and taken with the MS09-050 SMBv2 negotiate function index overflow (CVE-2009-3103) for a direct, unauthenticated SYSTEM shell.
- [Internal Writeup - Proving Grounds](https://hackindex.io/writeups/internal.md): Easy Windows box, an unpatched Windows Server 2008 SP1 host where the MS09-050 SMBv2 negotiate function index overflow (CVE-2009-3103) gives an unauthenticated SYSTEM shell in a single step.
- [Hunit Writeup - Proving Grounds](https://hackindex.io/writeups/hunit.md): Intermediate Linux box where a Spring Boot API leaks every user's password in plaintext for SSH access, then escalated to root by pushing a malicious script into a git repo a root cron job pulls and executes.
- [Image Writeup - Proving Grounds](https://hackindex.io/writeups/image.md): Intermediate Linux box exploiting CVE-2023-34152, an ImageMagick filename command injection, for a www-data shell, then escalating to root through a SUID strace binary.
- [Hepet Writeup - Proving Grounds](https://hackindex.io/writeups/hepet.md): Intermediate Windows box where a password leaked in an employee page's role field unlocks IMAP mail, a LibreOffice macro phishing email delivered over SMTP gives a user shell, and a writable VeyonService binary escalates to SYSTEM.
- [Hetemit Writeup - Proving Grounds](https://hackindex.io/writeups/hetemit.md): Intermediate Linux box where a Werkzeug API's /verify endpoint evaluates raw Python for a shell as cmeeks, then a writable systemd service file combined with a passwordless sudo reboot rule respawns that shell as root.
- [Fish Writeup - Proving Grounds](https://hackindex.io/writeups/fish.md): Intermediate Windows box where a GlassFish directory traversal leaks SynaMan SMTP credentials reused for RDP access, then a TotalAV antivirus quarantine bypass using a directory junction plants a malicious DLL for a SYSTEM shell.
- [Fired Writeup - Proving Grounds](https://hackindex.io/writeups/fired.md): Intermediate Linux box using Openfire's CVE-2023-32315 path traversal to create an unauthenticated admin account, uploading a malicious plugin for code execution, then reusing SMTP credentials from the embedded database log to escalate to root.
- [Kevin Writeup - Proving Grounds](https://hackindex.io/writeups/kevin.md): Easy Windows box where default admin:admin credentials expose HP Power Manager 4.2, and its pre-auth buffer overflow (CVE-2009-2685) gives a SYSTEM shell directly.
- [LaVita Writeup - Proving Grounds](https://hackindex.io/writeups/lavita.md): Intermediate Linux box running Laravel 8.4.0 with open registration, exploited by enabling debug mode and firing the CVE-2021-3129 Ignition log-poisoning RCE for a www-data shell, then escalated through a cron-executed artisan file and a scoped sudo Composer rule to root.
- [Marketing Writeup - Proving Grounds](https://hackindex.io/writeups/marketing.md): Intermediate Linux box exploiting a public LimeSurvey plugin RCE on a hidden vhost with default credentials, then chaining a leaked config password and a symlink-abused sudo rule to reach a second, fully privileged account.
- [Mantis Writeup - Proving Grounds](https://hackindex.io/writeups/mantis.md): Intermediate Linux box chaining a rogue-MySQL config leak and cracked admin hash into MantisBT's dot_tool command injection for a shell, then escalating to root via a cron-leaked database password reused on a sudo-ALL account.
- [Medjed Writeup - Proving Grounds](https://hackindex.io/writeups/medjed.md): Intermediate Windows box where a guessable password-reset reminder on a Rails quiz app leads to a SQL injection file write RCE, and insecure folder permissions in BarracudaDrive 6.5 escalate to SYSTEM.
- [Mice Writeup - Proving Grounds](https://hackindex.io/writeups/mice.md): Easy Windows box where an unauthenticated Remote Mouse 3.008 RCE gives a user shell, a base64-encoded saved FileZilla password gives RDP access, and a Remote Mouse file-dialog trick (CVE-2021-35448) escalates to Administrator.
- [Monster Writeup - Proving Grounds](https://hackindex.io/writeups/monster.md): Easy Windows box where a hint-guessed CMS admin password leaks database hashes, and cracking a user's hash leads to RDP access, then a writable XAMPP config hijack (CVE-2020-11107) escalates to Administrator.
- [Nibbles-PostgreSQL Writeup - Proving Grounds](https://hackindex.io/writeups/nibbles-postgredsql.md): Intermediate Linux box where default PostgreSQL credentials and COPY FROM PROGRAM give a postgres shell, then a SUID find binary escalates to root.
- [Nickel Writeup - Proving Grounds](https://hackindex.io/writeups/nickel.md): Intermediate Windows box where a custom API leaks a base64-encoded password through a process listing, and a cracked PDF reveals a SYSTEM-level command endpoint used to add the account to Administrators.
- [Nukem Writeup - Proving Grounds](https://hackindex.io/writeups/nukem.md): Intermediate Linux box running WordPress with the vulnerable Simple File List plugin, exploited via its arbitrary file upload bug (EDB-48979) for a shell, then escalated to root using a reused database password for SSH and a SUID dosbox binary that mounts the filesystem.
- [Ochima Writeup - Proving Grounds](https://hackindex.io/writeups/ochima.md): Intermediate Linux box exploiting CVE-2023-27163, an unauthenticated command injection in Maltrail's login endpoint, then escalating to root through a world-writable backup script run by cron.
- [Osaka Writeup - Proving Grounds](https://hackindex.io/writeups/osaka.md): Hard Windows box exploited through a custom FTP server's format-string info leak and a DEP-bypassing ROP chain for a buffer overflow shell, then escalated by abusing SeDebugPrivilege to impersonate winlogon and create a local administrator.
- [Payday Writeup - Proving Grounds](https://hackindex.io/writeups/payday.md): Intermediate Linux box running an outdated CS-Cart 1.3.3 store with a classes_dir local file inclusion that leaks /etc/passwd, leading to a guessable SSH password and an unrestricted sudo rule straight to root.
- [PC Writeup - Proving Grounds](https://hackindex.io/writeups/pc.md): Intermediate Linux box where a browser-based ttyd terminal gives a low-privileged shell, then CVE-2022-35411, an insecure pickle deserialization in a local rpc.py service running as root, gives immediate root.
- [Peppo Writeup - Proving Grounds](https://hackindex.io/writeups/peppo.md): Intermediate Linux box where Ident protocol enumeration leaks a username that doubles as its own SSH password, landing in a restricted shell that's escaped via the ed editor, and docker group membership alone is enough to mount the host filesystem and root the box.
- [Plum Writeup - Proving Grounds](https://hackindex.io/writeups/plum.md): Intermediate Linux box running PluXML 5.8.7 with default admin credentials, exploited through the CVE-2022-25018 static-page PHP injection for a www-data shell, then escalated to root via a plaintext password left in local mail.
- [Postfish Writeup - Proving Grounds](https://hackindex.io/writeups/postfish.md): Hard Linux mail server where a staff page and SMTP VRFY build a username list, a lazy POP3 password leaks an internal email that sets up a believable SMTP phishing attack against the sales manager, and his filter group membership plus a sudo mail rule lead to root.
- [Press Writeup - Proving Grounds](https://hackindex.io/writeups/press.md): Intermediate Linux box running FlatPress with default admin credentials, exploited via the CVE-2022-40048 upload RCE for a www-data shell, then escalated to root through a passwordless sudo rule on apt-get.
- [Pwned1 Writeup - Proving Grounds](https://hackindex.io/writeups/pwned1.md): Intermediate Linux box where a disclosed web page leaks FTP credentials and an SSH private key, a sudo rule on a messenger script allows command injection as another user, and docker group membership gives root via a host filesystem mount.
- [Sorcerer Writeup - Proving Grounds](https://hackindex.io/writeups/sorcerer.md): Intermediate Linux box where a public backup archive leaks an SSH key restricted by a forced command, bypassed via legacy SCP for a shell as max, then escalated to root through a SUID start-stop-daemon binary.
- [Snookums Writeup - Proving Grounds](https://hackindex.io/writeups/snookums.md): Intermediate Linux box running Simple PHP Photo Gallery 0.7, exploited via remote file inclusion for a www-data shell, then escalated to root through a base64-encoded MySQL password reused for SSH and PwnKit (CVE-2021-4034).
- [SLORT Writeup - Proving Grounds](https://hackindex.io/writeups/slort.md): Intermediate Windows box exploited through a remote file inclusion that downloads and runs a reverse shell under XAMPP, then escalated by swapping a scheduled job's writable executable for a payload that returns a shell as Administrator.
- [Sea Writeup - Proving Grounds](https://hackindex.io/writeups/sea.md): Intermediate Linux box running SeaCMS behind a randomized admin slug, where FTP logs leak both the slug and an LFI or SQLi path to the same SSH credential, then a cron job that blindly swaps binaries in /bin combined with a sudo NOPASSWD rule plants a SUID shell as root.
- [Shenzi Writeup - Proving Grounds](https://hackindex.io/writeups/shenzi.md): Intermediate Windows box where an anonymous SMB share leaks a WordPress password, used through the Theme Editor for a reverse shell, then an AlwaysInstallElevated misconfiguration escalates to SYSTEM via a malicious MSI.
- [Roquefort Writeup - Proving Grounds](https://hackindex.io/writeups/roquefort.md): Intermediate Linux box running Gitea 1.7.5 with open registration, exploited via the CVE-2019-11229 Git hook RCE to plant an SSH key, then escalated to root through a writable /usr/local/bin ahead of the cron PATH.
- [Robust Writeup - Proving Grounds](https://hackindex.io/writeups/robust.md): Easy Windows box where an X-Forwarded-For header bypasses an IP allowlist to reach a UNION-based SQL injection, leaking a user's password, then a Windows Sticky Notes database exposes the Administrator's password in plain text.
- [Readys Writeup - Proving Grounds](https://hackindex.io/writeups/readys.md): Intermediate Linux box where a WordPress plugin LFI leaks a Redis password used to plant a webshell for a shell as alice, then escalated to root through a tar wildcard injection in a cron job.
- [QuackerJack Writeup - Proving Grounds](https://hackindex.io/writeups/quackerjack.md): Intermediate Linux box running rConfig 3.9.4, chaining an unauthenticated SQL injection with a cracked admin hash and an authenticated RCE for a shell, then escalated to root through a SUID find binary.
- [SpiderSociety Writeup - Proving Grounds](https://hackindex.io/writeups/spidersociety.md): Intermediate Linux box where a default admin login exposes an unauthenticated secrets endpoint leaking FTP credentials, used to drop a webshell onto the web root, with a reused database password for SSH and a writable systemd unit for root.
- [SPX Writeup - Proving Grounds](https://hackindex.io/writeups/spx.md): Intermediate Linux box where an exposed phpinfo.php leaks an SPX profiler key, exploited via CVE-2024-42007 to read Tiny File Manager's bcrypt hashes, then password reuse and a sudo make install rule for root.
- [Squid Writeup - Proving Grounds](https://hackindex.io/writeups/squid.md): Easy Windows box where an open Squid proxy exposes a loopback-only phpMyAdmin with default credentials, used to write a webshell via INTO OUTFILE, then a recovered SeImpersonatePrivilege and PrintSpoofer escalate to SYSTEM.
- [Sybaris Writeup - Proving Grounds](https://hackindex.io/writeups/sybaris.md): Intermediate Linux box where anonymous FTP write access and an unauthenticated Redis instance combine for code execution via Redis MODULE LOAD, then a shared-object hijack of a root cron job's LD_LIBRARY_PATH for root.
- [Vmdak Writeup - Proving Grounds](https://hackindex.io/writeups/vmdak.md): Intermediate Linux box where a SQL injection bypasses a Prison Management System login for an upload-filter bypass RCE, then a reused database password and a tunneled Jenkins CVE chain for root.
- [WallpaperHub Writeup - Proving Grounds](https://hackindex.io/writeups/wallpaperhub.md): Intermediate Linux box where an unsanitized upload filename gives arbitrary file read, leaking a crackable SQLite password hash for SSH, then a sudo wildcard and the happy-dom CVE-2024-51757 code injection for root.
- [Workaholic Writeup - Proving Grounds](https://hackindex.io/writeups/workaholic.md): Intermediate Linux box running WordPress with the vulnerable wp-advanced-search plugin, exploited via CVE-2024-9796 unauthenticated SQLi to crack a password hash, then a reused database password for SSH, and a SUID binary's shared library dlopen hijack via a world-writable home directory for root.
- [XposedAPI Writeup - Proving Grounds](https://hackindex.io/writeups/xposedapi.md): Intermediate Linux box where an X-Forwarded-For header bypasses an internal API's IP restriction for an LFI and command injection chain, then a SUID wget overwrite of /etc/passwd for root.
- [ZenPhoto Writeup - Proving Grounds](https://hackindex.io/writeups/zenphoto.md): Intermediate Linux box running an outdated Zenphoto gallery with a public RCE exploit for a www-data shell, escalated to root through a CVE-2010-3904 kernel exploit in the RDS protocol.
- [Zipper Writeup - Proving Grounds](https://hackindex.io/writeups/zipper.md): Hard Linux box chaining a file upload with an LFI via the zip:// wrapper for a www-data shell, then abusing a 7z wildcard in a root cron job to leak a secret that doubles as the root password.
- [DC-1 Writeup - Proving Grounds](https://hackindex.io/writeups/dc-1.md): Easy Linux box running a vulnerable Drupal 7 site, exploited with Drupalgeddon2 (CVE-2018-7600) for a www-data shell, then escalated to root through a SUID find binary using a GTFOBins technique.
- [Codo Writeup - Proving Grounds](https://hackindex.io/writeups/codo.md): Easy Linux box running CodoForum v5.1 with default admin credentials, exploited via the CVE-2022-31854 authenticated file-upload RCE for a www-data shell, then escalated to root by reusing database credentials found in the web config.
- [Detection Writeup - Proving Grounds](https://hackindex.io/writeups/detection.md): Easy Linux box running an unauthenticated changedetection.io v0.45.1, exploited through a Jinja2 server-side template injection in the notification body (CVE-2024-32651). The application runs as root, so the SSTI yields a direct root shell with no privilege escalation.
- [EvilBox1 Writeup - Proving Grounds](https://hackindex.io/writeups/evilbox1.md): Easy Linux box with a local file inclusion that leaks an SSH private key, cracked for SSH access as mowree, then escalated to root through a world-writable /etc/passwd by adding a second UID 0 account.
- [Flimsy Writeup - Proving Grounds](https://hackindex.io/writeups/flimsy.md): Easy Linux box running Apache APISIX 2.8, exploited with CVE-2022-24112 for a low-privileged shell, then escalated to root through an APT Update Pre-Invoke hook in a writable apt.conf.d run by a root cron job.
- [FunBoxEasy Writeup - Proving Grounds](https://hackindex.io/writeups/funboxeasy.md): Easy Linux box with a book store web app vulnerable to SQL injection and default admin credentials, used to upload a PHP reverse shell for a www-data shell. A password file gives SSH access as tony, whose sudo rights include GTFOBins-exploitable binaries like pkexec for root.
- [FunBoxRookie Writeup - Proving Grounds](https://hackindex.io/writeups/funboxrookie.md): Easy Linux box with an anonymous FTP server holding a password-protected zip, cracked to recover an SSH key for tom. After escaping a restricted rbash shell, a MySQL history file leaks tom's password, and unrestricted sudo gives root.
- [Geisha Writeup - Proving Grounds](https://hackindex.io/writeups/geisha.md): Easy Linux box where the repeated hostname hints at the username geisha, whose SSH password is brute forced. A SUID base32 binary reads root's SSH private key, giving a root login.
- [Graph Writeup - Proving Grounds](https://hackindex.io/writeups/graph.md): Easy Linux box with an injectable GraphQL searchTerm over SQLite, used to dump and crack user hashes for SSH access as jane. A sudo-runnable pass-gen binary writes to /etc/shadow without stripping newlines, so a newline injection adds an account that reaches the shadow group and cracks the root hash.
- [Hawat Writeup - Proving Grounds](https://hackindex.io/writeups/hawat.md): Easy Linux box where default Nextcloud credentials expose the Issue Tracker source, revealing a SQL injection. A phpinfo page shows the server runs as root from /srv/http, so an INTO OUTFILE webshell gives code execution as root with no privilege escalation.
- [Inclusiveness Writeup - Proving Grounds](https://hackindex.io/writeups/inclusiveness.md): Easy Linux box chaining a User-Agent-gated local file inclusion with a writable anonymous FTP directory to upload and include a PHP webshell for RCE, then abusing a custom SUID binary's relative whoami call with a PATH hijack for root.
- [hub Writeup - Proving Grounds](https://hackindex.io/writeups/hub.md): Easy Linux box running FuguHub 8.1, exploited via CVE-2023-24078 by claiming admin through the config wizard and uploading a Lua Server Pages reverse shell. FuguHub runs as root, so the shell lands as root directly with no privilege escalation.
- [LazySysAdmin Writeup - Proving Grounds](https://hackindex.io/writeups/lazysysadmin.md): Easy Linux box where directory brute forcing reveals a WordPress user togie, whose weak SSH password is recovered by brute force. The account is in the sudo group, so sudo su gives root.
- [Outdated Writeup - Proving Grounds](https://hackindex.io/writeups/outdated.md): Easy Linux box where an mPDF HTML-to-PDF converter leaks a config file through its annotation file-read, giving SSH credentials. A localhost Webmin 1.996 is then exploited with its authenticated RCE (CVE-2022-36446), which runs as root, for a root shell.
- [Levram Writeup - Proving Grounds](https://hackindex.io/writeups/levram.md): Easy Linux box running Gerapy v0.9.7 with default admin credentials, exploited via the CVE-2021-32849 authenticated RCE for a shell as app, then escalated to root through a python3.10 binary carrying the cap_setuid capability.
- [Pebbles Writeup - Proving Grounds](https://hackindex.io/writeups/pebbles.md): Easy Linux box running ZoneMinder v1.29.0, exploited through a SQL injection in the limit parameter. The database runs as root, so sqlmap's os-shell injects a UDF and executes commands as root directly, with no separate privilege escalation.
- [PyLoader Writeup - Proving Grounds](https://hackindex.io/writeups/pyloader.md): Easy Linux box running pyLoad 0.5.0 on port 9666, exploited through the CVE-2023-0297 pre-authentication remote code execution. pyLoad runs as root, so the exploit lands a root shell directly with no privilege escalation.
- [RubyDome Writeup - Proving Grounds](https://hackindex.io/writeups/rubydome.md): Easy Linux box running a Ruby HTML-to-PDF app that uses the vulnerable PDFKit gem, exploited via CVE-2022-25765 command injection for a shell as andrew, then escalated to root through a NOPASSWD sudo rule on a writable Ruby script.
- [Seppuku Writeup - Proving Grounds](https://hackindex.io/writeups/seppuku.md): Easy Linux box leaking an SSH key and a custom password list that brute forces the seppuku account into a restricted shell. A root-owned password file is reused for samurai, whose sudo rule runs a missing binary in tanto's home, which is planted via the leaked key and run as samurai for root.
- [SunsetNoontide Writeup - Proving Grounds](https://hackindex.io/writeups/sunsetnoontide.md): Easy Linux box running the backdoored UnrealIRCd 3.2.8.1, exploited via CVE-2010-2075 for a shell as the server user, then escalated to root through a trivially weak root password.
- [wpwn Writeup - Proving Grounds](https://hackindex.io/writeups/wpwn.md): Easy Linux box running the vulnerable WordPress social-warfare plugin v3.5.2, exploited via CVE-2019-9978 for a www-data shell, then escalated to root by reusing the wp-config database password for the takis account, which has unrestricted sudo.
- [CyberSploit1 Writeup - Proving Grounds](https://hackindex.io/writeups/cybersploit1.md): Easy Linux box leaking a username in an HTML comment and a base64-encoded password in robots.txt, used to SSH in as itsskv, then escalating to root with the overlayfs kernel exploit on an outdated 3.13 kernel.
- [Crane Writeup - Proving Grounds](https://hackindex.io/writeups/crane.md): Easy Linux box running SuiteCRM with default admin credentials, exploited via CVE-2022-23940 for a www-data shell, then escalated to root through a sudo-allowed service binary with a GTFOBins path trick.
- [Cockpit Writeup - Proving Grounds](https://hackindex.io/writeups/cockpit.md): Intermediate Linux box exploiting a UNION-based SQL injection to dump credentials, reused against the Cockpit panel on port 9090 for a shell as james, then abusing a wildcard cp bug in a custom SUID binary to copy a setuid bash and gain root.
- [Walla Writeup - Proving Grounds](https://hackindex.io/writeups/walla.md): Easy Linux box with a RaspAP panel behind basic auth. Default credentials and the CVE-2020-24572 command injection give a www-data shell, then a writable Python script runnable as root via sudo escalates to root.
- [Pathway Writeup - Proving Grounds](https://hackindex.io/writeups/pathway.md): Intermediate Linux box exposing an unauthenticated LocalStack S3 bucket with plaintext credentials in users.json, used to SSH in as brian, then escalating to root by abusing an LD_PRELOAD-preserving sudo rule with a malicious shared object.
- [Flu Writeup - Proving Grounds](https://hackindex.io/writeups/flu.md): Intermediate Linux box exploiting Atlassian Confluence CVE-2022-26134 OGNL injection for remote code execution as the confluence user, then overwriting a root-run backup script in /opt to set SUID on bash for a root shell.
- [ClamAV Writeup - Proving Grounds](https://hackindex.io/writeups/clamav.md): Easy Linux box exploiting a Sendmail clamav-milter remote command execution vulnerability. SNMP leaks the black-hole-mode milter process, and a public Perl exploit injects an inetd bind shell for a root shell with no privilege escalation needed.