HackIndex.io
Language
Showing 1–15 of 15
Intermediate Linux box where an exposed .git history leaks database credentials used to reset SOPlanning's admin hash, unlocking CVE-2024-27114 for a shell, then a leaky cron job and a writable sudo script give root.
Intermediate Windows box running XAMPP, where a LibreOffice macro embedded in an uploaded ODT file gives a shell, a PHP webshell dropped into the Apache web root lands execution as the Apache service account, and GodPotato abuses its SeImpersonatePrivilege for a SYSTEM shell.
Hard Linux box where a default-credential FTP brute force yields a PCAP that reveals a hidden upload endpoint, exploited via the ExifTool CVE-2021-22204 RCE, then escalated to root with PwnKit (CVE-2021-4034).
Intermediate Linux box exploiting CVE-2023-34152, an ImageMagick filename command injection, for a www-data shell, then escalating to root through a SUID strace binary.
Intermediate Linux box using Openfire's CVE-2023-32315 path traversal to create an unauthenticated admin account, uploading a malicious plugin for code execution, then reusing SMTP credentials from the embedded database log to escalate to root.
Intermediate Linux box exploiting a public LimeSurvey plugin RCE on a hidden vhost with default credentials, then chaining a leaked config password and a symlink-abused sudo rule to reach a second, fully privileged account.
Intermediate Linux box running WordPress with the vulnerable Simple File List plugin, exploited via its arbitrary file upload bug (EDB-48979) for a shell, then escalated to root using a reused database password for SSH and a SUID dosbox binary that mounts the filesystem.
Intermediate Linux box running FlatPress with default admin credentials, exploited via the CVE-2022-40048 upload RCE for a www-data shell, then escalated to root through a passwordless sudo rule on apt-get.
Intermediate Linux box where a default admin login exposes an unauthenticated secrets endpoint leaking FTP credentials, used to drop a webshell onto the web root, with a reused database password for SSH and a writable systemd unit for root.
Intermediate Linux box where a SQL injection bypasses a Prison Management System login for an upload-filter bypass RCE, then a reused database password and a tunneled Jenkins CVE chain for root.
Intermediate Linux box where an unsanitized upload filename gives arbitrary file read, leaking a crackable SQLite password hash for SSH, then a sudo wildcard and the happy-dom CVE-2024-51757 code injection for root.
Hard Linux box chaining a file upload with an LFI via the zip:// wrapper for a www-data shell, then abusing a 7z wildcard in a root cron job to leak a secret that doubles as the root password.
Easy Linux box running CodoForum v5.1 with default admin credentials, exploited via the CVE-2022-31854 authenticated file-upload RCE for a www-data shell, then escalated to root by reusing database credentials found in the web config.
Easy Linux box with a book store web app vulnerable to SQL injection and default admin credentials, used to upload a PHP reverse shell for a www-data shell. A password file gives SSH access as tony, whose sudo rights include GTFOBins-exploitable binaries like pkexec for root.
Linux box rooted via SQLi authentication bypass in Subrion CMS, exploiting a file upload vulnerability to gain RCE, then leveraging a cronjob for privilege escalation.
Other platforms
We use cookies to improve your browsing experience, analyze site traffic, and personalize content. By clicking "Accept All", you consent to our use of cookies. Privacy Policy.