HackIndex.io
Language
Showing 1–24 of 34
Intermediate Linux box where a null-auth SMB share and the Cassandra Web directory traversal (EDB-49362) leak a FreeSWITCH event socket password and a reused credential, chained into FreeSWITCH command execution (EDB-47799) and SSH, then a sudo rule that reruns Cassandra Web as root leads to an SSH key and root.
Intermediate Linux box fronting TeamCity behind an nginx vhost, exploited via the CVE-2024-27198 authentication bypass, then a cracked SSH key and a chain of mail-leaked credentials across three users ends in a sudo pager escape (CVE-2023-26604) for root.
Intermediate Linux box where an exposed .git history leaks database credentials used to reset SOPlanning's admin hash, unlocking CVE-2024-27114 for a shell, then a leaky cron job and a writable sudo script give root.
Intermediate Linux box exposing its .git directory, leaking BoxBilling database credentials used to log into the admin panel, then exploited via the CVE-2022-3552 Twig SSTI for a shell, and escalated to root through a passwordless sudo rule.
Hard Linux box where a bookstore author's name doubles as the Weblate admin password, unlocking a Mercurial command injection for a shell, then a sudo-permitted git checkout script hijacked with a post-checkout hook gives root.
Intermediate Linux box running Jorani v1.0.0, exploited via the unauthenticated CVE-2023-26469 log-poisoning RCE for a user shell, then escalated to root through a passwordless sudo rule on env.
Intermediate Linux box where a Werkzeug API's /verify endpoint evaluates raw Python for a shell as cmeeks, then a writable systemd service file combined with a passwordless sudo reboot rule respawns that shell as root.
Intermediate Linux box running Laravel 8.4.0 with open registration, exploited by enabling debug mode and firing the CVE-2021-3129 Ignition log-poisoning RCE for a www-data shell, then escalated through a cron-executed artisan file and a scoped sudo Composer rule to root.
Intermediate Linux box exploiting a public LimeSurvey plugin RCE on a hidden vhost with default credentials, then chaining a leaked config password and a symlink-abused sudo rule to reach a second, fully privileged account.
Intermediate Linux box running an outdated CS-Cart 1.3.3 store with a classes_dir local file inclusion that leaks /etc/passwd, leading to a guessable SSH password and an unrestricted sudo rule straight to root.
Hard Linux mail server where a staff page and SMTP VRFY build a username list, a lazy POP3 password leaks an internal email that sets up a believable SMTP phishing attack against the sales manager, and his filter group membership plus a sudo mail rule lead to root.
Intermediate Linux box running FlatPress with default admin credentials, exploited via the CVE-2022-40048 upload RCE for a www-data shell, then escalated to root through a passwordless sudo rule on apt-get.
Intermediate Linux box where a disclosed web page leaks FTP credentials and an SSH private key, a sudo rule on a messenger script allows command injection as another user, and docker group membership gives root via a host filesystem mount.
Intermediate Linux box running SeaCMS behind a randomized admin slug, where FTP logs leak both the slug and an LFI or SQLi path to the same SSH credential, then a cron job that blindly swaps binaries in /bin combined with a sudo NOPASSWD rule plants a SUID shell as root.
Intermediate Linux box where a default admin login exposes an unauthenticated secrets endpoint leaking FTP credentials, used to drop a webshell onto the web root, with a reused database password for SSH and a writable systemd unit for root.
Intermediate Linux box where an exposed phpinfo.php leaks an SPX profiler key, exploited via CVE-2024-42007 to read Tiny File Manager's bcrypt hashes, then password reuse and a sudo make install rule for root.
Easy Linux box with a book store web app vulnerable to SQL injection and default admin credentials, used to upload a PHP reverse shell for a www-data shell. A password file gives SSH access as tony, whose sudo rights include GTFOBins-exploitable binaries like pkexec for root.
Easy Linux box with an anonymous FTP server holding a password-protected zip, cracked to recover an SSH key for tom. After escaping a restricted rbash shell, a MySQL history file leaks tom's password, and unrestricted sudo gives root.
Easy Linux box with an injectable GraphQL searchTerm over SQLite, used to dump and crack user hashes for SSH access as jane. A sudo-runnable pass-gen binary writes to /etc/shadow without stripping newlines, so a newline injection adds an account that reaches the shadow group and cracks the root hash.
Easy Linux box where directory brute forcing reveals a WordPress user togie, whose weak SSH password is recovered by brute force. The account is in the sudo group, so sudo su gives root.
Easy Linux box running a Ruby HTML-to-PDF app that uses the vulnerable PDFKit gem, exploited via CVE-2022-25765 command injection for a shell as andrew, then escalated to root through a NOPASSWD sudo rule on a writable Ruby script.
Easy Linux box leaking an SSH key and a custom password list that brute forces the seppuku account into a restricted shell. A root-owned password file is reused for samurai, whose sudo rule runs a missing binary in tanto's home, which is planted via the leaked key and run as samurai for root.
Easy Linux box running the vulnerable WordPress social-warfare plugin v3.5.2, exploited via CVE-2019-9978 for a www-data shell, then escalated to root by reusing the wp-config database password for the takis account, which has unrestricted sudo.
Easy Linux box running SuiteCRM with default admin credentials, exploited via CVE-2022-23940 for a www-data shell, then escalated to root through a sudo-allowed service binary with a GTFOBins path trick.
Other platforms
We use cookies to improve your browsing experience, analyze site traffic, and personalize content. By clicking "Accept All", you consent to our use of cookies. Privacy Policy.