HackIndex.io
Language
Showing 25–48 of 110
Intermediate Linux box where a Werkzeug API's /verify endpoint evaluates raw Python for a shell as cmeeks, then a writable systemd service file combined with a passwordless sudo reboot rule respawns that shell as root.
Intermediate Windows box where a password leaked in an employee page's role field unlocks IMAP mail, a LibreOffice macro phishing email delivered over SMTP gives a user shell, and a writable VeyonService binary escalates to SYSTEM.
Intermediate Windows box where a GlassFish directory traversal leaks SynaMan SMTP credentials reused for RDP access, then a TotalAV antivirus quarantine bypass using a directory junction plants a malicious DLL for a SYSTEM shell.
Intermediate Linux box using Openfire's CVE-2023-32315 path traversal to create an unauthenticated admin account, uploading a malicious plugin for code execution, then reusing SMTP credentials from the embedded database log to escalate to root.
Intermediate Linux box running Laravel 8.4.0 with open registration, exploited by enabling debug mode and firing the CVE-2021-3129 Ignition log-poisoning RCE for a www-data shell, then escalated through a cron-executed artisan file and a scoped sudo Composer rule to root.
Easy Windows box where default admin:admin credentials expose HP Power Manager 4.2, and its pre-auth buffer overflow (CVE-2009-2685) gives a SYSTEM shell directly.
Intermediate Linux box chaining a rogue-MySQL config leak and cracked admin hash into MantisBT's dot_tool command injection for a shell, then escalating to root via a cron-leaked database password reused on a sudo-ALL account.
Intermediate Linux box exploiting a public LimeSurvey plugin RCE on a hidden vhost with default credentials, then chaining a leaked config password and a symlink-abused sudo rule to reach a second, fully privileged account.
Intermediate Windows box where a guessable password-reset reminder on a Rails quiz app leads to a SQL injection file write RCE, and insecure folder permissions in BarracudaDrive 6.5 escalate to SYSTEM.
Easy Windows box where an unauthenticated Remote Mouse 3.008 RCE gives a user shell, a base64-encoded saved FileZilla password gives RDP access, and a Remote Mouse file-dialog trick (CVE-2021-35448) escalates to Administrator.
Easy Windows box where a hint-guessed CMS admin password leaks database hashes, and cracking a user's hash leads to RDP access, then a writable XAMPP config hijack (CVE-2020-11107) escalates to Administrator.
Intermediate Linux box where default PostgreSQL credentials and COPY FROM PROGRAM give a postgres shell, then a SUID find binary escalates to root.
Intermediate Linux box running WordPress with the vulnerable Simple File List plugin, exploited via its arbitrary file upload bug (EDB-48979) for a shell, then escalated to root using a reused database password for SSH and a SUID dosbox binary that mounts the filesystem.
Intermediate Windows box where a custom API leaks a base64-encoded password through a process listing, and a cracked PDF reveals a SYSTEM-level command endpoint used to add the account to Administrators.
Intermediate Linux box exploiting CVE-2023-27163, an unauthenticated command injection in Maltrail's login endpoint, then escalating to root through a world-writable backup script run by cron.
Hard Windows box exploited through a custom FTP server's format-string info leak and a DEP-bypassing ROP chain for a buffer overflow shell, then escalated by abusing SeDebugPrivilege to impersonate winlogon and create a local administrator.
Intermediate Linux box running an outdated CS-Cart 1.3.3 store with a classes_dir local file inclusion that leaks /etc/passwd, leading to a guessable SSH password and an unrestricted sudo rule straight to root.
Intermediate Linux box where a browser-based ttyd terminal gives a low-privileged shell, then CVE-2022-35411, an insecure pickle deserialization in a local rpc.py service running as root, gives immediate root.
Intermediate Linux box where Ident protocol enumeration leaks a username that doubles as its own SSH password, landing in a restricted shell that's escaped via the ed editor, and docker group membership alone is enough to mount the host filesystem and root the box.
Intermediate Linux box running PluXML 5.8.7 with default admin credentials, exploited through the CVE-2022-25018 static-page PHP injection for a www-data shell, then escalated to root via a plaintext password left in local mail.
Hard Linux mail server where a staff page and SMTP VRFY build a username list, a lazy POP3 password leaks an internal email that sets up a believable SMTP phishing attack against the sales manager, and his filter group membership plus a sudo mail rule lead to root.
Intermediate Linux box running FlatPress with default admin credentials, exploited via the CVE-2022-40048 upload RCE for a www-data shell, then escalated to root through a passwordless sudo rule on apt-get.
Intermediate Linux box where a disclosed web page leaks FTP credentials and an SSH private key, a sudo rule on a messenger script allows command injection as another user, and docker group membership gives root via a host filesystem mount.
Intermediate Linux box where a public backup archive leaks an SSH key restricted by a forced command, bypassed via legacy SCP for a shell as max, then escalated to root through a SUID start-stop-daemon binary.
Other platforms
We use cookies to improve your browsing experience, analyze site traffic, and personalize content. By clicking "Accept All", you consent to our use of cookies. Privacy Policy.