HackIndex.io
Language
Showing 1–18 of 18
Intermediate Linux box fronting TeamCity behind an nginx vhost, exploited via the CVE-2024-27198 authentication bypass, then a cracked SSH key and a chain of mail-leaked credentials across three users ends in a sudo pager escape (CVE-2023-26604) for root.
Intermediate Windows box where anonymous FTP enumeration and a brute-forced default admin password expose a cracked web credential, used to trigger an uploaded PHP reverse shell; a public Task Scheduler privilege escalation exploit then creates a local administrator account.
Intermediate Linux box chaining a Responsive Filemanager path traversal to leak OpenEMR's database credentials, cracking the dumped admin bcrypt hash for an authenticated OpenEMR RCE, then reusing the database password to escalate to root.
Hard Windows box where a malicious ODT upload leaks a NetNTLM hash that cracks to valid credentials, exposing a writable SMB share mapped to the web root for a PHP shell; a passwordless local MySQL running as SYSTEM then writes a DLL into System32 for a WerTrigger DLL-hijack SYSTEM shell.
Intermediate Linux box chaining a rogue-MySQL config leak and cracked admin hash into MantisBT's dot_tool command injection for a shell, then escalating to root via a cron-leaked database password reused on a sudo-ALL account.
Easy Windows box where a hint-guessed CMS admin password leaks database hashes, and cracking a user's hash leads to RDP access, then a writable XAMPP config hijack (CVE-2020-11107) escalates to Administrator.
Intermediate Windows box where a custom API leaks a base64-encoded password through a process listing, and a cracked PDF reveals a SYSTEM-level command endpoint used to add the account to Administrators.
Intermediate Linux box running rConfig 3.9.4, chaining an unauthenticated SQL injection with a cracked admin hash and an authenticated RCE for a shell, then escalated to root through a SUID find binary.
Intermediate Linux box where an exposed phpinfo.php leaks an SPX profiler key, exploited via CVE-2024-42007 to read Tiny File Manager's bcrypt hashes, then password reuse and a sudo make install rule for root.
Intermediate Linux box where an unsanitized upload filename gives arbitrary file read, leaking a crackable SQLite password hash for SSH, then a sudo wildcard and the happy-dom CVE-2024-51757 code injection for root.
Intermediate Linux box running WordPress with the vulnerable wp-advanced-search plugin, exploited via CVE-2024-9796 unauthenticated SQLi to crack a password hash, then a reused database password for SSH, and a SUID binary's shared library dlopen hijack via a world-writable home directory for root.
Easy Linux box with a local file inclusion that leaks an SSH private key, cracked for SSH access as mowree, then escalated to root through a world-writable /etc/passwd by adding a second UID 0 account.
Easy Linux box with an anonymous FTP server holding a password-protected zip, cracked to recover an SSH key for tom. After escaping a restricted rbash shell, a MySQL history file leaks tom's password, and unrestricted sudo gives root.
Easy Linux box with an injectable GraphQL searchTerm over SQLite, used to dump and crack user hashes for SSH access as jane. A sudo-runnable pass-gen binary writes to /etc/shadow without stripping newlines, so a newline injection adds an account that reaches the shadow group and cracks the root hash.
Linux box exploiting web app for RCE via PHP, pivoting through user enumeration and sudo misconfiguration for root privilege escalation.
Compromise a Linux machine via LFI to log poisoning through SSH, escalate using MySQL running as root to write a SUID shell.
Exploit WordPress via user enumeration, brute-force creds, upload PHP reverse shell, then escalate privileges using a writable passwd file.
Exploit WordPress plugin vulnerability on a hidden subdomain, escalate via writable Docker-related files to root on this Easy Linux box.
Other platforms
We use cookies to improve your browsing experience, analyze site traffic, and personalize content. By clicking "Accept All", you consent to our use of cookies. Privacy Policy.