Posts tagged with

mysql

HackTheBox - Devvortex Writeup

Devvortex is an easy Hack The Box Linux machine running Joomla CMS vulnerable to info disclosure. The config file exposes plaintext admin credentials, enabling template injection for RCE. Cracked database hashes grant SSH access. Privilege escalation is achieved via apport-cli, run as root.

S SH∆FIQ∆IM∆N
February 16, 2025
1 min read

ffuf ffuf-vhost gobuster joomla! php-reverse-shell mysql hashcat apport-cli CVE-2023-1326 CVE-2023-26604 CVE-2023-23752
HackTheBox - Surveillance Writeup

Surveillance is a medium-difficulty Linux machine featuring Craft CMS [CVE-2023-41892] PHP object injection for initial access. Privilege escalation involves authenticated RCE in ZoneMinder and a sudo misconfiguration using LD_PRELOAD, leading to root access.

S SH∆FIQ∆IM∆N
February 2, 2025
1 min read

CVE-2023-41892 CVE-2023-26035 gobuster craftcms rce mysql crackstation linpeas chisel zoneminder dpkg check-installed
HackTheBox - MonitorsTwo Writeup

MonitorsTwo is an easy Hack The Box Linux machine featuring pre-auth RCE via a malicious X-Forwarded-For header, leading to a Docker container shell. A misconfigured SUID capsh binary grants root in the container. Cracked MySQL credentials allow SSH access to the host. Privilege escalation is achieved by exploiting Docker CVE-2021-41091 to access container-mounted files and reuse a SUID Bash binary.

S SH∆FIQ∆IM∆N
September 3, 2023
1 min read

CVE-2022-46169 CVE-2021-41091 upgrade-shell-using-script rce GTFOBins capsh mysql john docker
HackTheBox - Busqueda Writeup

Busqueda is an easy Hack The Box Linux machine involving command injection in a Python module for initial access. Credentials found in a Git config file provide access to a local Gitea instance. A system checkup script with root permissions exposes Docker container credentials for the Gitea admin. Abusing a relative path vulnerability in the script leads to root RCE and full privilege escalation.

S SH∆FIQ∆IM∆N
July 8, 2023
1 min read

python mysql gitea rce searchor 2.4.0 docker docker-inspect