HackIndex.io
Language
Showing 1–24 of 34
Intermediate Linux box where a null-auth SMB share and the Cassandra Web directory traversal (EDB-49362) leak a FreeSWITCH event socket password and a reused credential, chained into FreeSWITCH command execution (EDB-47799) and SSH, then a sudo rule that reruns Cassandra Web as root leads to an SSH key and root.
Intermediate Linux box where a Rails mass assignment flaw bypasses email confirmation, a file manager's local file inclusion plants an SSH key for a foothold, and a root private key left in a user's home directory gives privilege escalation.
Intermediate Linux box exposing its .git directory, leaking BoxBilling database credentials used to log into the admin panel, then exploited via the CVE-2022-3552 Twig SSTI for a shell, and escalated to root through a passwordless sudo rule.
Hard Windows box where a malicious ODT upload leaks a NetNTLM hash that cracks to valid credentials, exposing a writable SMB share mapped to the web root for a PHP shell; a passwordless local MySQL running as SYSTEM then writes a DLL into System32 for a WerTrigger DLL-hijack SYSTEM shell.
Intermediate Windows box where an unauthenticated directory traversal in Argus Surveillance DVR leaks an SSH private key for initial access, then the same traversal exposes a custom-encoded Administrator password that is decoded and reused via runas for an Administrator shell.
Intermediate Linux box where a world-browsable admin logs directory leaks a user's password, and a SUID Serv-U FTP Server binary gives a known local privilege escalation straight to root.
Intermediate Linux box using Grafana's CVE-2021-43798 directory traversal to leak and decrypt a Prometheus data source password for SSH access, then abusing disk group membership to read root's SSH key off the raw block device.
Intermediate Linux box where a Spring Boot API leaks every user's password in plaintext for SSH access, then escalated to root by pushing a malicious script into a git repo a root cron job pulls and executes.
Intermediate Windows box where a password leaked in an employee page's role field unlocks IMAP mail, a LibreOffice macro phishing email delivered over SMTP gives a user shell, and a writable VeyonService binary escalates to SYSTEM.
Intermediate Windows box where a GlassFish directory traversal leaks SynaMan SMTP credentials reused for RDP access, then a TotalAV antivirus quarantine bypass using a directory junction plants a malicious DLL for a SYSTEM shell.
Intermediate Linux box chaining a rogue-MySQL config leak and cracked admin hash into MantisBT's dot_tool command injection for a shell, then escalating to root via a cron-leaked database password reused on a sudo-ALL account.
Easy Windows box where an unauthenticated Remote Mouse 3.008 RCE gives a user shell, a base64-encoded saved FileZilla password gives RDP access, and a Remote Mouse file-dialog trick (CVE-2021-35448) escalates to Administrator.
Easy Windows box where a hint-guessed CMS admin password leaks database hashes, and cracking a user's hash leads to RDP access, then a writable XAMPP config hijack (CVE-2020-11107) escalates to Administrator.
Intermediate Linux box running WordPress with the vulnerable Simple File List plugin, exploited via its arbitrary file upload bug (EDB-48979) for a shell, then escalated to root using a reused database password for SSH and a SUID dosbox binary that mounts the filesystem.
Intermediate Windows box where a custom API leaks a base64-encoded password through a process listing, and a cracked PDF reveals a SYSTEM-level command endpoint used to add the account to Administrators.
Intermediate Linux box running an outdated CS-Cart 1.3.3 store with a classes_dir local file inclusion that leaks /etc/passwd, leading to a guessable SSH password and an unrestricted sudo rule straight to root.
Intermediate Linux box running PluXML 5.8.7 with default admin credentials, exploited through the CVE-2022-25018 static-page PHP injection for a www-data shell, then escalated to root via a plaintext password left in local mail.
Intermediate Linux box where a disclosed web page leaks FTP credentials and an SSH private key, a sudo rule on a messenger script allows command injection as another user, and docker group membership gives root via a host filesystem mount.
Intermediate Linux box where a public backup archive leaks an SSH key restricted by a forced command, bypassed via legacy SCP for a shell as max, then escalated to root through a SUID start-stop-daemon binary.
Intermediate Windows box where an anonymous SMB share leaks a WordPress password, used through the Theme Editor for a reverse shell, then an AlwaysInstallElevated misconfiguration escalates to SYSTEM via a malicious MSI.
Easy Windows box where an X-Forwarded-For header bypasses an IP allowlist to reach a UNION-based SQL injection, leaking a user's password, then a Windows Sticky Notes database exposes the Administrator's password in plain text.
Intermediate Linux box where a WordPress plugin LFI leaks a Redis password used to plant a webshell for a shell as alice, then escalated to root through a tar wildcard injection in a cron job.
Intermediate Linux box where a default admin login exposes an unauthenticated secrets endpoint leaking FTP credentials, used to drop a webshell onto the web root, with a reused database password for SSH and a writable systemd unit for root.
Intermediate Linux box where an exposed phpinfo.php leaks an SPX profiler key, exploited via CVE-2024-42007 to read Tiny File Manager's bcrypt hashes, then password reuse and a sudo make install rule for root.
Other platforms
We use cookies to improve your browsing experience, analyze site traffic, and personalize content. By clicking "Accept All", you consent to our use of cookies. Privacy Policy.