HackIndex.io
Language
Showing 1–21 of 21
Exploit a PlaySMS RCE vulnerability after decoding OOK/Brainfuck/Base64 creds, then escalate via SUID rop binary with ret2libc.
Insane Linux box exploiting blockchain smart contract vulnerabilities and complex service synergies to achieve full system compromise.
Linux box exploiting NoSQL injection to bypass MongoDB login, SSH with harvested credentials, then privilege escalation via SUID jjs binary.
Exploit SQL injection and LFI on a Linux web server, upload a malicious file for RCE, then escalate privileges to root via SUID binary abuse.
SNMP enumeration reveals hidden vhosts and CockpitCMS credentials. Exploits lead to RCE via file upload, then SNMP-triggered script for root.
Exploit Drupalgeddon2 RCE on a Drupal site, crack harvested MySQL creds, then abuse dirty_sock via snap for root escalation.
SQL injection on hotel booking site leads to RCE via SQLMap's file write. Escalate through command injection in a script and sudo abuse of systemctl.
SQL injection auth bypass, webshell upload via image magic bytes, mysqldump credential harvesting, and suid binary PATH hijack for root.
Linear programming attack on a custom XOR-based encryption scheme to recover the flag by solving constraints derived from the cipher's operations.
Exploit a Linux machine by abusing misconfigured services and weak credentials to gain initial access, then escalate privileges through vulnerable SUID binaries.
Memory forensics challenge using Volatility to analyze a Linux memory dump, extracting artifacts to uncover hidden flags through process and file analysis.
Hard Windows box involving advanced exploitation techniques, privilege escalation, and lateral movement through a complex Active Directory or web application environment.
Exploit a web app leaking user cohort data to enumerate valid credentials, then leverage misconfigured SSH access to escalate privileges on this easy Linux box.
Exploit a Flask SSTI vulnerability in a developer hub app to gain RCE, then escalate privileges via misconfigured sudo or SUID binaries on Linux.
Unauthenticated Next.js RCE via React2Shell (CVE-2025-55182), crack a reused hash from the app SQLite database for SSH, then abuse a root Node --inspect debug port for root.
Exploit an invite code API flaw to register, abuse command injection in VPN generation, then leverage CVE-2023-0386 OverlayFS for root escalation.
Exploit a Node.js app with SSTI in Handlebars and privilege escalation via a misconfigured SUID binary on an Easy Linux HackTheBox machine.
Exploit a Pterodactyl game panel via subdomain enumeration, command injection, and privilege escalation to root on this medium Linux box.
Reverse engineer a custom bytecode interpreter binary, analyze its instruction set, and craft malicious bytecode to achieve RCE on a Linux target.
Linux box exploiting Overleaf-based file upload vulnerability to gain RCE, then leveraging a misconfigured sudo privilege for root escalation.
SQL injection in Cacti leads to RCE, followed by port forwarding and privilege escalation techniques to fully compromise this Windows machine.
Other platforms
We use cookies to improve your browsing experience, analyze site traffic, and personalize content. By clicking "Accept All", you consent to our use of cookies. Privacy Policy.