HEKK

OFFSEC - Proving Grounds - DECEPTION

22 August 2026·1886 words·9 mins

OFFSEC PG PRACTICE WORDPRESS SUID

WordPress enumeration revealed users and a hint leading to a split password. We combined it to gain SSH access, then exploited SUID /usr/bin/python2.7 to escalate privileges to root.

OFFSEC - Proving Grounds - LAZYSYSADMIN

22 August 2026·2133 words·11 mins

OFFSEC PG PRACTICE SMBMAP SMBCLIENT WORDPRESS RCE

SMB share access revealed WordPress credentials. After logging into WordPress, we achieved RCE and initial access. Reused togie’s password to gain sudo privileges and escalate to root.

OFFSEC - Proving Grounds - SCARECROW1.1

22 August 2026·1985 words·10 mins

OFFSEC PG PRACTICE XXE PHP WRAPPER NEWLINE INJECTION SUID

Used XXE and PHP wrappers to read files/source code, bypassed the upload blacklist with a PHP reverse shell for initial access, then exploited SUID find to escalate privileges to root.

OFFSEC - Proving Grounds - FIVE86.2

21 August 2026·2232 words·11 mins

OFFSEC PG PRACTICE WPSCAN PWNKIT

A WordPress site is compromised via brute-forced credentials and an exploited vulnerable plugin. Initial access is gained, then LinPEAS identifies PwnKit (CVE-2021-4034), enabling privilege escalation to root.

OFFSEC - Proving Grounds - PWNLAB

21 August 2026·2531 words·12 mins

OFFSEC PG PRACTICE PHP WRAPPER MYSQL MAGIC BYTE PHP REVERSE SHELL DIRTYCOW CVE-2016-5195

Exploited PHP wrappers/LFI to access DB credentials, extract web credentials, upload a malicious GIF/PHP reverse shell, gain access, then exploit DirtyCow (CVE-2016-5195) for root.

OFFSEC - Proving Grounds - CONFUSION

20 August 2026·2036 words·10 mins

OFFSEC PG PRACTICE CACTI DOAS SUID

A Cacti HTTPS exploit is adapted for RCE. Database credentials enable lateral movement to james, who can modify /usr/local/sbin/systeminfo and run it as root via doas, enabling privilege escalation.

OFFSEC - Proving Grounds - FUXA

20 August 2026·1058 words·5 mins

OFFSEC PG PRACTICE FUXA

Fuxa v1.2.4-2188 is exposed on port 1881. A public exploit for the SCADA/HMI software provides remote code execution, allowing us to gain root access to the server.

OFFSEC - Proving Grounds - NEEDLE

19 August 2026·2329 words·11 mins

OFFSEC PG PRACTICE HTTP HEADER SVG XSL

Exploit on port 80 the contact form’s SVG upload function with a special HTTP header to access the medical dashboard. Abuse XSL_PATH during PDF discharge summary generation to inject a custom XSL file and achieve RCE.

OFFSEC - Proving Grounds - MEDITRACK

18 August 2026·2059 words·10 mins

OFFSEC PG PRACTICE SQLITE GITEA FLASK PICKLE CVE-2026-41651

SQLi on port 9000 dumps creds. Crack meditrackDev for Gitea access. Find Flask secret to forge admin cookie, then import snapshot for Pickle RCE. Escalate to root via CVE-2026-41651.

OFFSEC - Proving Grounds - VANITY

13 October 2025·2106 words·10 mins

OFFSEC PG PRACTICE RSYNC NMAP COMMAND INJECTION

Rsync on 873 shares web application source code, using cmd injection gains initial access. Abuse rsync cronjob with -e option to get root.

OFFSEC - Proving Grounds - POSTFISH

12 October 2025·3193 words·15 mins

OFFSEC PG PRACTICE SMTP-USER-ENUM USERNAME_GENERATOR HYDRA IMAP IMAPS SENDEMAIL PWNKIT

Website PostFish on port 80 and SMTP on port 25 reveal usernames. Hydra finds credentials, sending an email with a reset link grants brian access. Pwnkit (CVE-2021-4034) escalates to root.

OFFSEC - Proving Grounds - RUSSIANDOLLS

12 October 2025·2291 words·11 mins

OFFSEC PG PRACTICE PATH TRAVERSAL NXC SUDO 1.9.14-17 CVE-2025-32463

On port 8080 the website loads images via local http URLs, found open port 4242 with FILE VIEWER app. Path traversal exposes passwords and allows access via SSH. sudo v1.9.15 exploited for root access using CVE-2025-32463 chroot escalation.

OFFSEC - Proving Grounds - DEVELOP

11 October 2025·4146 words·20 mins

OFFSEC PG PRACTICE GIT TCPDUMP COMMAND INJECTION IFS PYTHON WEBSERVER POST PWNKIT

Access Git repository on port 80 for credentials, login application on port 8080 and use command injection to retrieve a SSH key. Exploit CVE-2021-4034 to become root.

OFFSEC - Proving Grounds - PASSPORT

11 October 2025·2987 words·15 mins

OFFSEC PG PRACTICE FEROXBUSTER SSH2JOHN JOHN TMUX

Access website on port 80, extract credentials, log into FTP. Crack Luigi’s SSH key and gain initial access. Move laterally to luca and attach to a root tmux session for privilege escalation.

OFFSEC - Proving Grounds - SYBARIS

10 October 2025·1959 words·10 mins

OFFSEC PG PRACTICE FTP REDIS NXC PWNKIT

FTP on port 21 allows anonymous login and is writable. Redis 5.0.9 on port 6379 is exploitable by uploading a Redis module via FTP and exploit Redis for pablo access, then use pwnkit (CVE-2021-4034) to escalate to root.

OFFSEC - Proving Grounds - DRIBBLE

9 October 2025·2272 words·11 mins

OFFSEC PG PRACTICE NODE.JS SUDO BARON SAMEDIT

Web application on port 3000 allows admin access via modified cookie. Exploit Sudo Baron Samedit (CVE-2021-3156) to gain root.

OFFSEC - Proving Grounds - LUNAR

8 October 2025·2959 words·14 mins

OFFSEC PG PRACTICE STRCMP LOG POISONING SHOWMOUNT NO_ROOT_SQUASH NFS

Download zip from port 80, exploit PHP for LFI, use log poisoning for RCE as www-data. SSH with liam’s key for lateral movement and escalate to root via NFS no_root_squash.

OFFSEC - Proving Grounds - MARKETING

5 October 2025·2728 words·13 mins

OFFSEC PG PRACTICE LIMESURVEY MLOCATE

LimeSurvey 5.3.24 on port 80 has weak credentials, RCE gives www-data access. Find credentials and move laterally to t.miller, use sudo sync.sh to reach m.sander, then sudo to root.

HEKK

Own The Grind

Recent