HackIndex.io
Language
Showing 1–24 of 110
Intermediate Linux box where a null-auth SMB share and the Cassandra Web directory traversal (EDB-49362) leak a FreeSWITCH event socket password and a reused credential, chained into FreeSWITCH command execution (EDB-47799) and SSH, then a sudo rule that reruns Cassandra Web as root leads to an SSH key and root.
Intermediate Linux box exploiting CVE-2022-35914 in an exposed htmLawed test page for a www-data shell, then escalating to root via a writable cron script.
Intermediate Linux box fronting TeamCity behind an nginx vhost, exploited via the CVE-2024-27198 authentication bypass, then a cracked SSH key and a chain of mail-leaked credentials across three users ends in a sudo pager escape (CVE-2023-26604) for root.
Intermediate Linux box where an exposed .git history leaks database credentials used to reset SOPlanning's admin hash, unlocking CVE-2024-27114 for a shell, then a leaky cron job and a writable sudo script give root.
Intermediate Linux box where a Rails mass assignment flaw bypasses email confirmation, a file manager's local file inclusion plants an SSH key for a foothold, and a root private key left in a user's home directory gives privilege escalation.
Intermediate Windows box where anonymous FTP enumeration and a brute-forced default admin password expose a cracked web credential, used to trigger an uploaded PHP reverse shell; a public Task Scheduler privilege escalation exploit then creates a local administrator account.
Intermediate Windows box where a guessed Sonatype Nexus Repository Manager login leads to an authenticated remote code execution exploit, and the unpatched SMBGhost (CVE-2020-0796) SMBv3 kernel exploit then escalates to SYSTEM.
Intermediate Linux box chaining a Responsive Filemanager path traversal to leak OpenEMR's database credentials, cracking the dumped admin bcrypt hash for an authenticated OpenEMR RCE, then reusing the database password to escalate to root.
Easy Windows box where SmarterMail build 6919 on a non-standard port is hit directly with a public remote code execution exploit for an immediate SYSTEM shell, with no further privilege escalation required.
Intermediate Windows box running XAMPP, where a LibreOffice macro embedded in an uploaded ODT file gives a shell, a PHP webshell dropped into the Apache web root lands execution as the Apache service account, and GodPotato abuses its SeImpersonatePrivilege for a SYSTEM shell.
Intermediate Linux box exposing its .git directory, leaking BoxBilling database credentials used to log into the admin panel, then exploited via the CVE-2022-3552 Twig SSTI for a shell, and escalated to root through a passwordless sudo rule.
Hard Windows box where a malicious ODT upload leaks a NetNTLM hash that cracks to valid credentials, exposing a writable SMB share mapped to the web root for a PHP shell; a passwordless local MySQL running as SYSTEM then writes a DLL into System32 for a WerTrigger DLL-hijack SYSTEM shell.
Intermediate Windows box where an unauthenticated directory traversal in Argus Surveillance DVR leaks an SSH private key for initial access, then the same traversal exposes a custom-encoded Administrator password that is decoded and reused via runas for an Administrator shell.
Intermediate Linux box where a world-browsable admin logs directory leaks a user's password, and a SUID Serv-U FTP Server binary gives a known local privilege escalation straight to root.
Hard Linux box where a default-credential FTP brute force yields a PCAP that reveals a hidden upload endpoint, exploited via the ExifTool CVE-2021-22204 RCE, then escalated to root with PwnKit (CVE-2021-4034).
Intermediate Linux box using Grafana's CVE-2021-43798 directory traversal to leak and decrypt a Prometheus data source password for SSH access, then abusing disk group membership to read root's SSH key off the raw block device.
Hard Linux box where a bookstore author's name doubles as the Weblate admin password, unlocking a Mercurial command injection for a shell, then a sudo-permitted git checkout script hijacked with a post-checkout hook gives root.
Intermediate Linux box where File Browser's default credentials and an enabled shell feature give command execution, an uploaded SSH key gives a foothold as david, and a SUID aa-exec binary gives root through GTFOBins.
Intermediate Windows box where an unauthenticated H2 database console gives remote code execution through a JNI DLL write, and SeImpersonatePrivilege is escalated to SYSTEM with GodPotato.
Intermediate Linux box running Jorani v1.0.0, exploited via the unauthenticated CVE-2023-26469 log-poisoning RCE for a user shell, then escalated to root through a passwordless sudo rule on env.
Easy Windows box, an unpatched Windows Server 2008 SP1 host flagged by nmap's SMB vulnerability scripts and taken with the MS09-050 SMBv2 negotiate function index overflow (CVE-2009-3103) for a direct, unauthenticated SYSTEM shell.
Easy Windows box, an unpatched Windows Server 2008 SP1 host where the MS09-050 SMBv2 negotiate function index overflow (CVE-2009-3103) gives an unauthenticated SYSTEM shell in a single step.
Intermediate Linux box where a Spring Boot API leaks every user's password in plaintext for SSH access, then escalated to root by pushing a malicious script into a git repo a root cron job pulls and executes.
Intermediate Linux box exploiting CVE-2023-34152, an ImageMagick filename command injection, for a www-data shell, then escalating to root through a SUID strace binary.
Other platforms
We use cookies to improve your browsing experience, analyze site traffic, and personalize content. By clicking "Accept All", you consent to our use of cookies. Privacy Policy.