HackIndex.io
Language
Showing 1–24 of 92
SSRF and SSTI exploitation chain on a Linux web target, leveraging command injection to achieve remote code execution and capture the flag.
Exploit an open SMB share on a Windows machine using smbclient to enumerate shares and retrieve the hidden flag without credentials.
Beginner-friendly TryHackMe room covering Telnet enumeration, anonymous login, and capturing the flag on a vulnerable Linux machine.
Exploiting a Node.js app via prototype pollution and SSRF to gain RCE, then escalating privileges through a misconfigured service on a Hard Linux HTB box.
Exploit Oracle DB on Windows via ODAT for RCE, upload a web shell, then leverage Oracle SYSDBA privileges to escalate and retrieve flags.
Exploit Strapi CMS RCE on a subdomain, gain shell, then pivot via SSH tunneling to attack a local Laravel app for root.
IKE/IPSec enumeration to establish VPN tunnel, then exploiting FTP upload to IIS webroot for RCE via ASP shell, escalating via SeImpersonatePrivilege.
Exploited a Windows machine via SSRF to leak VOTD app credentials, then used a file upload shell to gain access and abused AlwaysInstallElevated for privesc.
Exploit a PlaySMS RCE vulnerability after decoding OOK/Brainfuck/Base64 creds, then escalate via SUID rop binary with ret2libc.
YAML deserialization flaw exploited via SnakeYAML to gain foothold, then abusing WASM/bash script path hijacking for privilege escalation on Linux.
Exploiting MS08-067 and MS17-010 vulnerabilities on an unpatched Windows XP machine to gain SYSTEM-level access without user interaction.
Exploit OpenNetAdmin RCE to gain initial access, pivot through internal web configs for credentials, then escalate via nano GTFOBins sudo misconfiguration.
Exploit WordPress on a subdomain to gain RCE, leverage DNS zone transfer for recon, and abuse sudoers misconfiguration for root escalation.
Insane Linux box exploiting blockchain smart contract vulnerabilities and complex service synergies to achieve full system compromise.
Hard Windows box involving complex exploitation chain with service enumeration, privilege escalation, and advanced attack techniques to achieve full system compromise.
Insane Windows box involving SSRF, certificate services abuse, ADCS ESC1, and Shadow Credentials to escalate through Active Directory.
Other platforms
We use cookies to improve your browsing experience, analyze site traffic, and personalize content. By clicking "Accept All", you consent to our use of cookies. Privacy Policy.