Proving Grounds Writeups

110 writeups 44× Easy 4× Medium 8× Hard

Difficulty

Tag

Access

Sort

Tag: path-hijacking Clear all

Showing 1–2 of 2

Intermediate Linux

Roquefort Writeup - Proving Grounds

Intermediate Linux box running Gitea 1.7.5 with open registration, exploited via the CVE-2019-11229 Git hook RCE to plant an SSH key, then escalated to root through a writable /usr/local/bin ahead of the cron PATH.

rce path-hijacking cron-abuse privilege-escalation +2

The Husky Hacker • Oct 8, 2026 • 3 min read

Easy Linux

Inclusiveness Writeup - Proving Grounds

Easy Linux box chaining a User-Agent-gated local file inclusion with a writable anonymous FTP directory to upload and include a PHP webshell for RCE, then abusing a custom SUID binary's relative whoami call with a PATH hijack for root.

lfi rce ftp anonymous-access +3

The Husky Hacker • Oct 7, 2026 • 3 min read

Other platforms

HackTheBox 92 TryHackMe 10 All writeups