HackIndex.io
Language
Showing 1–16 of 16
Exploit Oracle DB on Windows via ODAT for RCE, upload a web shell, then leverage Oracle SYSDBA privileges to escalate and retrieve flags.
IKE/IPSec enumeration to establish VPN tunnel, then exploiting FTP upload to IIS webroot for RCE via ASP shell, escalating via SeImpersonatePrivilege.
Exploited a Windows machine via SSRF to leak VOTD app credentials, then used a file upload shell to gain access and abused AlwaysInstallElevated for privesc.
Exploit OpenNetAdmin RCE to gain initial access, pivot through internal web configs for credentials, then escalate via nano GTFOBins sudo misconfiguration.
Exploit SQL injection and LFI on a Linux web server, upload a malicious file for RCE, then escalate privileges to root via SUID binary abuse.
Exploit second-order SQLi to steal credentials, abuse a SMB share to upload a PHP webshell, then escape WSL to escalate to SYSTEM.
Windows IIS box exploited via malicious web.config upload for RCE, then escalated to SYSTEM using token impersonation with Metasploit.
Exploit anonymous FTP write access on IIS to upload an ASPX web shell, then escalate privileges via MS11-046 kernel exploit on Windows.
SNMP enumeration reveals hidden vhosts and CockpitCMS credentials. Exploits lead to RCE via file upload, then SNMP-triggered script for root.
Exploit Drupalgeddon2 RCE on a Drupal site, crack harvested MySQL creds, then abuse dirty_sock via snap for root escalation.
SQL injection auth bypass, webshell upload via image magic bytes, mysqldump credential harvesting, and suid binary PATH hijack for root.
SQL injection on a web app leads to credential extraction, enabling SSH access. Privilege escalation via misconfigured Linux permissions yields root.
Linear programming attack on a custom XOR-based encryption scheme to recover the flag by solving constraints derived from the cipher's operations.
Exploit MongoDB misconfiguration with unauthenticated access to enumerate databases and retrieve credentials, ultimately gaining root on an easy Linux box.
PHP type juggling vulnerability exploited via loose comparison to bypass authentication and gain RCE through crafted input manipulation on a Linux web challenge.
Other platforms
We use cookies to improve your browsing experience, analyze site traffic, and personalize content. By clicking "Accept All", you consent to our use of cookies. Privacy Policy.