HackIndex.io
Language
Showing 49–72 of 110
Intermediate Windows box exploited through a remote file inclusion that downloads and runs a reverse shell under XAMPP, then escalated by swapping a scheduled job's writable executable for a payload that returns a shell as Administrator.
Intermediate Linux box running Simple PHP Photo Gallery 0.7, exploited via remote file inclusion for a www-data shell, then escalated to root through a base64-encoded MySQL password reused for SSH and PwnKit (CVE-2021-4034).
Intermediate Linux box running SeaCMS behind a randomized admin slug, where FTP logs leak both the slug and an LFI or SQLi path to the same SSH credential, then a cron job that blindly swaps binaries in /bin combined with a sudo NOPASSWD rule plants a SUID shell as root.
Intermediate Windows box where an anonymous SMB share leaks a WordPress password, used through the Theme Editor for a reverse shell, then an AlwaysInstallElevated misconfiguration escalates to SYSTEM via a malicious MSI.
Easy Windows box where an X-Forwarded-For header bypasses an IP allowlist to reach a UNION-based SQL injection, leaking a user's password, then a Windows Sticky Notes database exposes the Administrator's password in plain text.
Intermediate Linux box running Gitea 1.7.5 with open registration, exploited via the CVE-2019-11229 Git hook RCE to plant an SSH key, then escalated to root through a writable /usr/local/bin ahead of the cron PATH.
Intermediate Linux box running rConfig 3.9.4, chaining an unauthenticated SQL injection with a cracked admin hash and an authenticated RCE for a shell, then escalated to root through a SUID find binary.
Intermediate Linux box where a WordPress plugin LFI leaks a Redis password used to plant a webshell for a shell as alice, then escalated to root through a tar wildcard injection in a cron job.
Intermediate Linux box where a default admin login exposes an unauthenticated secrets endpoint leaking FTP credentials, used to drop a webshell onto the web root, with a reused database password for SSH and a writable systemd unit for root.
Intermediate Linux box where an exposed phpinfo.php leaks an SPX profiler key, exploited via CVE-2024-42007 to read Tiny File Manager's bcrypt hashes, then password reuse and a sudo make install rule for root.
Easy Windows box where an open Squid proxy exposes a loopback-only phpMyAdmin with default credentials, used to write a webshell via INTO OUTFILE, then a recovered SeImpersonatePrivilege and PrintSpoofer escalate to SYSTEM.
Intermediate Linux box where anonymous FTP write access and an unauthenticated Redis instance combine for code execution via Redis MODULE LOAD, then a shared-object hijack of a root cron job's LD_LIBRARY_PATH for root.
Intermediate Linux box where a SQL injection bypasses a Prison Management System login for an upload-filter bypass RCE, then a reused database password and a tunneled Jenkins CVE chain for root.
Intermediate Linux box where an unsanitized upload filename gives arbitrary file read, leaking a crackable SQLite password hash for SSH, then a sudo wildcard and the happy-dom CVE-2024-51757 code injection for root.
Intermediate Linux box running WordPress with the vulnerable wp-advanced-search plugin, exploited via CVE-2024-9796 unauthenticated SQLi to crack a password hash, then a reused database password for SSH, and a SUID binary's shared library dlopen hijack via a world-writable home directory for root.
Intermediate Linux box where an X-Forwarded-For header bypasses an internal API's IP restriction for an LFI and command injection chain, then a SUID wget overwrite of /etc/passwd for root.
Intermediate Linux box running an outdated Zenphoto gallery with a public RCE exploit for a www-data shell, escalated to root through a CVE-2010-3904 kernel exploit in the RDS protocol.
Hard Linux box chaining a file upload with an LFI via the zip:// wrapper for a www-data shell, then abusing a 7z wildcard in a root cron job to leak a secret that doubles as the root password.
Easy Linux box running a vulnerable Drupal 7 site, exploited with Drupalgeddon2 (CVE-2018-7600) for a www-data shell, then escalated to root through a SUID find binary using a GTFOBins technique.
Easy Linux box running CodoForum v5.1 with default admin credentials, exploited via the CVE-2022-31854 authenticated file-upload RCE for a www-data shell, then escalated to root by reusing database credentials found in the web config.
Easy Linux box running an unauthenticated changedetection.io v0.45.1, exploited through a Jinja2 server-side template injection in the notification body (CVE-2024-32651). The application runs as root, so the SSTI yields a direct root shell with no privilege escalation.
Easy Linux box running Apache APISIX 2.8, exploited with CVE-2022-24112 for a low-privileged shell, then escalated to root through an APT Update Pre-Invoke hook in a writable apt.conf.d run by a root cron job.
Easy Linux box with a local file inclusion that leaks an SSH private key, cracked for SSH access as mowree, then escalated to root through a world-writable /etc/passwd by adding a second UID 0 account.
Easy Linux box with a book store web app vulnerable to SQL injection and default admin credentials, used to upload a PHP reverse shell for a www-data shell. A password file gives SSH access as tony, whose sudo rights include GTFOBins-exploitable binaries like pkexec for root.
Other platforms
We use cookies to improve your browsing experience, analyze site traffic, and personalize content. By clicking "Accept All", you consent to our use of cookies. Privacy Policy.