HackIndex.io
Language
Showing 1–23 of 23
Intermediate Linux box where a world-browsable admin logs directory leaks a user's password, and a SUID Serv-U FTP Server binary gives a known local privilege escalation straight to root.
Hard Linux box where a default-credential FTP brute force yields a PCAP that reveals a hidden upload endpoint, exploited via the ExifTool CVE-2021-22204 RCE, then escalated to root with PwnKit (CVE-2021-4034).
Intermediate Linux box where File Browser's default credentials and an enabled shell feature give command execution, an uploaded SSH key gives a foothold as david, and a SUID aa-exec binary gives root through GTFOBins.
Intermediate Linux box exploiting CVE-2023-34152, an ImageMagick filename command injection, for a www-data shell, then escalating to root through a SUID strace binary.
Intermediate Linux box where default PostgreSQL credentials and COPY FROM PROGRAM give a postgres shell, then a SUID find binary escalates to root.
Intermediate Linux box running WordPress with the vulnerable Simple File List plugin, exploited via its arbitrary file upload bug (EDB-48979) for a shell, then escalated to root using a reused database password for SSH and a SUID dosbox binary that mounts the filesystem.
Intermediate Linux box where a browser-based ttyd terminal gives a low-privileged shell, then CVE-2022-35411, an insecure pickle deserialization in a local rpc.py service running as root, gives immediate root.
Intermediate Linux box where a public backup archive leaks an SSH key restricted by a forced command, bypassed via legacy SCP for a shell as max, then escalated to root through a SUID start-stop-daemon binary.
Intermediate Linux box running rConfig 3.9.4, chaining an unauthenticated SQL injection with a cracked admin hash and an authenticated RCE for a shell, then escalated to root through a SUID find binary.
Intermediate Linux box where an X-Forwarded-For header bypasses an internal API's IP restriction for an LFI and command injection chain, then a SUID wget overwrite of /etc/passwd for root.
Easy Linux box running a vulnerable Drupal 7 site, exploited with Drupalgeddon2 (CVE-2018-7600) for a www-data shell, then escalated to root through a SUID find binary using a GTFOBins technique.
Easy Linux box where the repeated hostname hints at the username geisha, whose SSH password is brute forced. A SUID base32 binary reads root's SSH private key, giving a root login.
Easy Linux box chaining a User-Agent-gated local file inclusion with a writable anonymous FTP directory to upload and include a PHP webshell for RCE, then abusing a custom SUID binary's relative whoami call with a PATH hijack for root.
Intermediate Linux box exploiting a UNION-based SQL injection to dump credentials, reused against the Cockpit panel on port 9090 for a shell as james, then abusing a wildcard cp bug in a custom SUID binary to copy a setuid bash and gain root.
Intermediate Linux box exploiting Atlassian Confluence CVE-2022-26134 OGNL injection for remote code execution as the confluence user, then overwriting a root-run backup script in /opt to set SUID on bash for a root shell.
Boot2root Linux box exploiting Webmin vulnerability for initial foothold, then leveraging SUID binary or misconfigurations for root privilege escalation.
Exploiting an outdated WordPress installation on a Linux box via SSH enumeration, privilege escalation through a writable bash history and SUID binaries.
Exploit WordPress plugins for RCE, escalate via sudo misconfiguration and SUID binaries on this Linux box to capture both flags.
Compromise a Linux machine via LFI to log poisoning through SSH, escalate using MySQL running as root to write a SUID shell.
Boot2root Linux box exploiting weak credentials via FTP enumeration, then escalating privileges using a SUID gdb binary to achieve root access.
Exploit WordPress via user enumeration, brute-force creds, upload PHP reverse shell, then escalate privileges using a writable passwd file.
Easy Linux box exploiting Grav CMS with CVE-2021-21425 for RCE, then leveraging a SUID `php7.4` binary for privilege escalation to root.
Exploited Redis and Lua sandbox escape for RCE, then leveraged a SUID binary vulnerability to escalate privileges to root on this Linux machine.
Other platforms
We use cookies to improve your browsing experience, analyze site traffic, and personalize content. By clicking "Accept All", you consent to our use of cookies. Privacy Policy.