HackIndex.io
Language
Showing 1–24 of 55
Exploit a PlaySMS RCE vulnerability after decoding OOK/Brainfuck/Base64 creds, then escalate via SUID rop binary with ret2libc.
YAML deserialization flaw exploited via SnakeYAML to gain foothold, then abusing WASM/bash script path hijacking for privilege escalation on Linux.
Exploit OpenNetAdmin RCE to gain initial access, pivot through internal web configs for credentials, then escalate via nano GTFOBins sudo misconfiguration.
Exploit WordPress on a subdomain to gain RCE, leverage DNS zone transfer for recon, and abuse sudoers misconfiguration for root escalation.
Insane Linux box exploiting blockchain smart contract vulnerabilities and complex service synergies to achieve full system compromise.
SMB enumeration reveals credentials and DNS zones. Exploiting LFI with PHP injection leads to a shell, then Python library hijacking for root.
Windows box exploiting Achat buffer overflow for initial foothold, then abusing weak file permissions and stored credentials for privilege escalation.
Exploit an open MatterMost server and helpdesk ticket email trick to gain internal credentials, then crack a bcrypt hash using custom rules for root.
Linux box exploiting NoSQL injection to bypass MongoDB login, SSH with harvested credentials, then privilege escalation via SUID jjs binary.
Exploit SSTI in Doctor's messaging app via log poisoning, gain RCE as web user, then escalate via Splunk Universal Forwarder credentials.
Exploit a Minecraft server's exposed plugin JAR containing hardcoded credentials to gain SSH access and escalate to root via sudo misconfiguration.
Windows machine exploited via Drupal RCE (CVE-2018-7600), followed by privilege escalation using MS15-051 kernel exploit to gain SYSTEM access.
Exploit SQL injection and LFI on a Linux web server, upload a malicious file for RCE, then escalate privileges to root via SUID binary abuse.
Exploit second-order SQLi to steal credentials, abuse a SMB share to upload a PHP webshell, then escape WSL to escalate to SYSTEM.
Windows IIS box exploited via malicious web.config upload for RCE, then escalated to SYSTEM using token impersonation with Metasploit.
Exploit anonymous FTP write access on IIS to upload an ASPX web shell, then escalate privileges via MS11-046 kernel exploit on Windows.
SNMP enumeration reveals hidden vhosts and CockpitCMS credentials. Exploits lead to RCE via file upload, then SNMP-triggered script for root.
Exploit default Tomcat credentials to upload a malicious WAR file, gaining a shell as SYSTEM on this beginner-friendly Windows machine.
Exploit Drupalgeddon2 RCE on a Drupal site, crack harvested MySQL creds, then abuse dirty_sock via snap for root escalation.
Exploit Jenkins via firewall bypass, extract credentials, abuse Active Directory delegation and ACL misconfigurations to escalate privileges on Windows.
Insane Linux box involving RSA key exploitation, SMTP enumeration, WordPress vulnerabilities, and complex privilege escalation techniques.
Active Directory exploitation via AS-REP roasting, SMB enumeration, BloodHound analysis, ForceChangePassword abuse, and SeBackupPrivilege for NTDS.dit extraction.
SQL injection on hotel booking site leads to RCE via SQLMap's file write. Escalate through command injection in a script and sudo abuse of systemctl.
SQL injection auth bypass, webshell upload via image magic bytes, mysqldump credential harvesting, and suid binary PATH hijack for root.
Other platforms
We use cookies to improve your browsing experience, analyze site traffic, and personalize content. By clicking "Accept All", you consent to our use of cookies. Privacy Policy.