HackIndex.io
Language
Showing 1–11 of 11
Intermediate Linux box exploiting CVE-2022-35914 in an exposed htmLawed test page for a www-data shell, then escalating to root via a writable cron script.
Hard Linux box where a bookstore author's name doubles as the Weblate admin password, unlocking a Mercurial command injection for a shell, then a sudo-permitted git checkout script hijacked with a post-checkout hook gives root.
Intermediate Linux box exploiting CVE-2023-34152, an ImageMagick filename command injection, for a www-data shell, then escalating to root through a SUID strace binary.
Intermediate Linux box where a Werkzeug API's /verify endpoint evaluates raw Python for a shell as cmeeks, then a writable systemd service file combined with a passwordless sudo reboot rule respawns that shell as root.
Intermediate Linux box chaining a rogue-MySQL config leak and cracked admin hash into MantisBT's dot_tool command injection for a shell, then escalating to root via a cron-leaked database password reused on a sudo-ALL account.
Intermediate Windows box where a custom API leaks a base64-encoded password through a process listing, and a cracked PDF reveals a SYSTEM-level command endpoint used to add the account to Administrators.
Intermediate Linux box exploiting CVE-2023-27163, an unauthenticated command injection in Maltrail's login endpoint, then escalating to root through a world-writable backup script run by cron.
Intermediate Linux box where an X-Forwarded-For header bypasses an internal API's IP restriction for an LFI and command injection chain, then a SUID wget overwrite of /etc/passwd for root.
Easy Linux box running a Ruby HTML-to-PDF app that uses the vulnerable PDFKit gem, exploited via CVE-2022-25765 command injection for a shell as andrew, then escalated to root through a NOPASSWD sudo rule on a writable Ruby script.
Easy Linux box with a RaspAP panel behind basic auth. Default credentials and the CVE-2020-24572 command injection give a www-data shell, then a writable Python script runnable as root via sudo escalates to root.
Exploited Exhibitor ZooKeeper RCE to gain foothold, then leveraged password reuse via sudo `password` binary to escalate to root.
Other platforms
We use cookies to improve your browsing experience, analyze site traffic, and personalize content. By clicking "Accept All", you consent to our use of cookies. Privacy Policy.