HackIndex.io
Language
Showing 1–17 of 17
Intermediate Linux box where File Browser's default credentials and an enabled shell feature give command execution, an uploaded SSH key gives a foothold as david, and a SUID aa-exec binary gives root through GTFOBins.
Intermediate Linux box running Jorani v1.0.0, exploited via the unauthenticated CVE-2023-26469 log-poisoning RCE for a user shell, then escalated to root through a passwordless sudo rule on env.
Intermediate Linux box exploiting CVE-2023-34152, an ImageMagick filename command injection, for a www-data shell, then escalating to root through a SUID strace binary.
Intermediate Linux box running Laravel 8.4.0 with open registration, exploited by enabling debug mode and firing the CVE-2021-3129 Ignition log-poisoning RCE for a www-data shell, then escalated through a cron-executed artisan file and a scoped sudo Composer rule to root.
Intermediate Linux box where default PostgreSQL credentials and COPY FROM PROGRAM give a postgres shell, then a SUID find binary escalates to root.
Hard Linux mail server where a staff page and SMTP VRFY build a username list, a lazy POP3 password leaks an internal email that sets up a believable SMTP phishing attack against the sales manager, and his filter group membership plus a sudo mail rule lead to root.
Intermediate Linux box running FlatPress with default admin credentials, exploited via the CVE-2022-40048 upload RCE for a www-data shell, then escalated to root through a passwordless sudo rule on apt-get.
Intermediate Linux box where a public backup archive leaks an SSH key restricted by a forced command, bypassed via legacy SCP for a shell as max, then escalated to root through a SUID start-stop-daemon binary.
Intermediate Linux box running rConfig 3.9.4, chaining an unauthenticated SQL injection with a cracked admin hash and an authenticated RCE for a shell, then escalated to root through a SUID find binary.
Intermediate Linux box where an X-Forwarded-For header bypasses an internal API's IP restriction for an LFI and command injection chain, then a SUID wget overwrite of /etc/passwd for root.
Easy Linux box running a vulnerable Drupal 7 site, exploited with Drupalgeddon2 (CVE-2018-7600) for a www-data shell, then escalated to root through a SUID find binary using a GTFOBins technique.
Easy Linux box with a book store web app vulnerable to SQL injection and default admin credentials, used to upload a PHP reverse shell for a www-data shell. A password file gives SSH access as tony, whose sudo rights include GTFOBins-exploitable binaries like pkexec for root.
Easy Linux box where the repeated hostname hints at the username geisha, whose SSH password is brute forced. A SUID base32 binary reads root's SSH private key, giving a root login.
Easy Linux box running SuiteCRM with default admin credentials, exploited via CVE-2022-23940 for a www-data shell, then escalated to root through a sudo-allowed service binary with a GTFOBins path trick.
Exploit WordPress plugins for RCE, escalate via sudo misconfiguration and SUID binaries on this Linux box to capture both flags.
Boot2root Linux box exploiting weak credentials via FTP enumeration, then escalating privileges using a SUID gdb binary to achieve root access.
Exploit WordPress via user enumeration, brute-force creds, upload PHP reverse shell, then escalate privileges using a writable passwd file.
Other platforms
We use cookies to improve your browsing experience, analyze site traffic, and personalize content. By clicking "Accept All", you consent to our use of cookies. Privacy Policy.