Hack The Box

Linux machine exploiting a public OpenNetAdmin RCE, chaining reused database credentials into an internal-only site, and abusing a sudo-permitted nano binary for root.

Linux machine leaking SSH credentials over SNMP, exploiting a Pandora FMS SQL injection to hijack a session, chaining an event feature into command execution, and hijacking a SUID binary’s relative tar call for root.

Linux machine chaining an LFI-executed webshell (staged via phpLiteAdmin), a port-knocked SSH key hidden with steganography, and a chkrootkit cron exploit for root.

Linux machine exploiting the Magento Shoplift SQL injection to create an admin user, chaining an authenticated Magento RCE for a shell, and abusing a sudo vi rule for root.

Linux machine chaining a leaked custom header from an exposed .git repo, a phar-wrapper file upload bypass with disabled-function evasion, a Python 2 input() SUID exploit, and sudo easy_install for root.

Linux machine bypassing MIME-based upload filters with forged magic bytes, exploiting an unsanitised filename in a cron job, then a network config script’s variable-parsing quirk for root.

Linux target chained from a Metabase pre-auth RCE through Docker credential disclosure to an OverlayFS kernel exploit for root.

Linux box that starts with an exposed PHP web shell, pivots through sudo-based lateral movement, and finishes with cron-driven privilege escalation.

Linux machine exploiting Apache ActiveMQ (CVE-2023-46604) for initial access, then abusing sudo nginx rights for root.

Linux machine bypassing a torrent hosting site’s file upload filter via a Content-Type header change to get a PHP webshell, then exploiting a PAM file-tampering vulnerability for root.