Proving Grounds Writeups

110 writeups 44× Easy 4× Medium 8× Hard

Difficulty

Tag

Access

Sort

Tag: boxbilling Clear all

Showing 1–1 of 1

Intermediate Linux

BullyBox Writeup - Proving Grounds

Intermediate Linux box exposing its .git directory, leaking BoxBilling database credentials used to log into the admin panel, then exploited via the CVE-2022-3552 Twig SSTI for a shell, and escalated to root through a passwordless sudo rule.

ssti boxbilling sudo-misconfiguration information-disclosure +2

The Husky Hacker • Oct 8, 2026 • 3 min read

Other platforms

HackTheBox 92 TryHackMe 10 All writeups