HackIndex.io
Language
Showing 73–96 of 110
Easy Linux box with an anonymous FTP server holding a password-protected zip, cracked to recover an SSH key for tom. After escaping a restricted rbash shell, a MySQL history file leaks tom's password, and unrestricted sudo gives root.
Easy Linux box where the repeated hostname hints at the username geisha, whose SSH password is brute forced. A SUID base32 binary reads root's SSH private key, giving a root login.
Easy Linux box with an injectable GraphQL searchTerm over SQLite, used to dump and crack user hashes for SSH access as jane. A sudo-runnable pass-gen binary writes to /etc/shadow without stripping newlines, so a newline injection adds an account that reaches the shadow group and cracks the root hash.
Easy Linux box where default Nextcloud credentials expose the Issue Tracker source, revealing a SQL injection. A phpinfo page shows the server runs as root from /srv/http, so an INTO OUTFILE webshell gives code execution as root with no privilege escalation.
Easy Linux box running FuguHub 8.1, exploited via CVE-2023-24078 by claiming admin through the config wizard and uploading a Lua Server Pages reverse shell. FuguHub runs as root, so the shell lands as root directly with no privilege escalation.
Easy Linux box chaining a User-Agent-gated local file inclusion with a writable anonymous FTP directory to upload and include a PHP webshell for RCE, then abusing a custom SUID binary's relative whoami call with a PATH hijack for root.
Easy Linux box where directory brute forcing reveals a WordPress user togie, whose weak SSH password is recovered by brute force. The account is in the sudo group, so sudo su gives root.
Easy Linux box running Gerapy v0.9.7 with default admin credentials, exploited via the CVE-2021-32849 authenticated RCE for a shell as app, then escalated to root through a python3.10 binary carrying the cap_setuid capability.
Easy Linux box where an mPDF HTML-to-PDF converter leaks a config file through its annotation file-read, giving SSH credentials. A localhost Webmin 1.996 is then exploited with its authenticated RCE (CVE-2022-36446), which runs as root, for a root shell.
Easy Linux box running ZoneMinder v1.29.0, exploited through a SQL injection in the limit parameter. The database runs as root, so sqlmap's os-shell injects a UDF and executes commands as root directly, with no separate privilege escalation.
Easy Linux box running pyLoad 0.5.0 on port 9666, exploited through the CVE-2023-0297 pre-authentication remote code execution. pyLoad runs as root, so the exploit lands a root shell directly with no privilege escalation.
Easy Linux box running a Ruby HTML-to-PDF app that uses the vulnerable PDFKit gem, exploited via CVE-2022-25765 command injection for a shell as andrew, then escalated to root through a NOPASSWD sudo rule on a writable Ruby script.
Easy Linux box leaking an SSH key and a custom password list that brute forces the seppuku account into a restricted shell. A root-owned password file is reused for samurai, whose sudo rule runs a missing binary in tanto's home, which is planted via the leaked key and run as samurai for root.
Easy Linux box running the backdoored UnrealIRCd 3.2.8.1, exploited via CVE-2010-2075 for a shell as the server user, then escalated to root through a trivially weak root password.
Easy Linux box running the vulnerable WordPress social-warfare plugin v3.5.2, exploited via CVE-2019-9978 for a www-data shell, then escalated to root by reusing the wp-config database password for the takis account, which has unrestricted sudo.
Easy Linux box leaking a username in an HTML comment and a base64-encoded password in robots.txt, used to SSH in as itsskv, then escalating to root with the overlayfs kernel exploit on an outdated 3.13 kernel.
Easy Linux box running SuiteCRM with default admin credentials, exploited via CVE-2022-23940 for a www-data shell, then escalated to root through a sudo-allowed service binary with a GTFOBins path trick.
Intermediate Linux box exploiting a UNION-based SQL injection to dump credentials, reused against the Cockpit panel on port 9090 for a shell as james, then abusing a wildcard cp bug in a custom SUID binary to copy a setuid bash and gain root.
Easy Linux box with a RaspAP panel behind basic auth. Default credentials and the CVE-2020-24572 command injection give a www-data shell, then a writable Python script runnable as root via sudo escalates to root.
Intermediate Linux box exposing an unauthenticated LocalStack S3 bucket with plaintext credentials in users.json, used to SSH in as brian, then escalating to root by abusing an LD_PRELOAD-preserving sudo rule with a malicious shared object.
Intermediate Linux box exploiting Atlassian Confluence CVE-2022-26134 OGNL injection for remote code execution as the confluence user, then overwriting a root-run backup script in /opt to set SUID on bash for a root shell.
Easy Linux box exploiting a Sendmail clamav-milter remote command execution vulnerability. SNMP leaks the black-hole-mode milter process, and a public Perl exploit injects an inetd bind shell for a root shell with no privilege escalation needed.
Salt-stack CVE-2020-11651 exploitation on Linux target to achieve unauthenticated RCE as root via the SaltStack master service.
Boot2root Linux box exploiting Webmin vulnerability for initial foothold, then leveraging SUID binary or misconfigurations for root privilege escalation.
Other platforms
We use cookies to improve your browsing experience, analyze site traffic, and personalize content. By clicking "Accept All", you consent to our use of cookies. Privacy Policy.