HackIndex.io
Language
Showing 1–20 of 20
Intermediate Windows box where anonymous FTP enumeration and a brute-forced default admin password expose a cracked web credential, used to trigger an uploaded PHP reverse shell; a public Task Scheduler privilege escalation exploit then creates a local administrator account.
Hard Linux box where a default-credential FTP brute force yields a PCAP that reveals a hidden upload endpoint, exploited via the ExifTool CVE-2021-22204 RCE, then escalated to root with PwnKit (CVE-2021-4034).
Intermediate Linux box where File Browser's default credentials and an enabled shell feature give command execution, an uploaded SSH key gives a foothold as david, and a SUID aa-exec binary gives root through GTFOBins.
Easy Windows box where default admin:admin credentials expose HP Power Manager 4.2, and its pre-auth buffer overflow (CVE-2009-2685) gives a SYSTEM shell directly.
Intermediate Linux box exploiting a public LimeSurvey plugin RCE on a hidden vhost with default credentials, then chaining a leaked config password and a symlink-abused sudo rule to reach a second, fully privileged account.
Intermediate Linux box where default PostgreSQL credentials and COPY FROM PROGRAM give a postgres shell, then a SUID find binary escalates to root.
Intermediate Linux box where Ident protocol enumeration leaks a username that doubles as its own SSH password, landing in a restricted shell that's escaped via the ed editor, and docker group membership alone is enough to mount the host filesystem and root the box.
Intermediate Linux box running PluXML 5.8.7 with default admin credentials, exploited through the CVE-2022-25018 static-page PHP injection for a www-data shell, then escalated to root via a plaintext password left in local mail.
Hard Linux mail server where a staff page and SMTP VRFY build a username list, a lazy POP3 password leaks an internal email that sets up a believable SMTP phishing attack against the sales manager, and his filter group membership plus a sudo mail rule lead to root.
Intermediate Linux box running FlatPress with default admin credentials, exploited via the CVE-2022-40048 upload RCE for a www-data shell, then escalated to root through a passwordless sudo rule on apt-get.
Intermediate Linux box where a default admin login exposes an unauthenticated secrets endpoint leaking FTP credentials, used to drop a webshell onto the web root, with a reused database password for SSH and a writable systemd unit for root.
Easy Windows box where an open Squid proxy exposes a loopback-only phpMyAdmin with default credentials, used to write a webshell via INTO OUTFILE, then a recovered SeImpersonatePrivilege and PrintSpoofer escalate to SYSTEM.
Easy Linux box running CodoForum v5.1 with default admin credentials, exploited via the CVE-2022-31854 authenticated file-upload RCE for a www-data shell, then escalated to root by reusing database credentials found in the web config.
Easy Linux box with a book store web app vulnerable to SQL injection and default admin credentials, used to upload a PHP reverse shell for a www-data shell. A password file gives SSH access as tony, whose sudo rights include GTFOBins-exploitable binaries like pkexec for root.
Easy Linux box where default Nextcloud credentials expose the Issue Tracker source, revealing a SQL injection. A phpinfo page shows the server runs as root from /srv/http, so an INTO OUTFILE webshell gives code execution as root with no privilege escalation.
Easy Linux box running the backdoored UnrealIRCd 3.2.8.1, exploited via CVE-2010-2075 for a shell as the server user, then escalated to root through a trivially weak root password.
Easy Linux box running SuiteCRM with default admin credentials, exploited via CVE-2022-23940 for a www-data shell, then escalated to root through a sudo-allowed service binary with a GTFOBins path trick.
Exploiting Nagios XI via authenticated RCE CVE-2019-15949, then escalating privileges using sudo rights to gain root on Linux.
Linux box rooted via SQLi authentication bypass in Subrion CMS, exploiting a file upload vulnerability to gain RCE, then leveraging a cronjob for privilege escalation.
Exploit WordPress plugin vulnerability on a hidden subdomain, escalate via writable Docker-related files to root on this Easy Linux box.
Other platforms
We use cookies to improve your browsing experience, analyze site traffic, and personalize content. By clicking "Accept All", you consent to our use of cookies. Privacy Policy.