Writeups on HEKK

OFFSEC - Proving Grounds - FLINK

info@hekk.one — Tue, 01 Sep 2026 00:00:00 +0000

Apache Flink 2.0.0 on port 8081 is exploited via Metasploit’s JAR Upload RCE module for initial access. LinPEAS identifies Pack2TheRoot (CVE-2026-41651), enabling privilege escalation to root.

OFFSEC - Proving Grounds - CARRYOVER

info@hekk.one — Sun, 30 Aug 2026 00:00:00 +0000

Carvilla on port 80 is vulnerable to SQL injection, providing initial access via SQLmap. An exposed LD_PRELOAD variable enables a custom shared object to be executed with sudo, escalating privileges to root.

OFFSEC - Proving Grounds - ZAB

info@hekk.one — Sun, 30 Aug 2026 00:00:00 +0000

Gobuster finds local.txt on port 80. A Mage web app on port 6789 provides browser-based terminal access. The server is vulnerable to Pack2TheRoot (CVE-2026-41651), enabling privilege escalation to root.

OFFSEC - Proving Grounds - GLIDER

info@hekk.one — Sat, 29 Aug 2026 00:00:00 +0000

XXE on port 80 enables PHP file reads and RCE. After gaining access, pspy64 reveals Mosquitto credentials; subscribing to the MQTT topic exposes root credentials.

OFFSEC - Proving Grounds - BACKUPBUDDY

info@hekk.one — Fri, 28 Aug 2026 00:00:00 +0000

PHP File Manager on port 80 allows default login and path traversal to Brian’s SSH key. SSH access is gained, then CVE-2026-41651 is exploited to become root.

OFFSEC - Proving Grounds - PATHWAY

info@hekk.one — Fri, 28 Aug 2026 00:00:00 +0000

Port 4566 exposes credentials, enabling SSH access. Sudo permits passwordless /usr/bin/ping, and the set LD_PRELOAD variable can be abused to compile a C payload and escalate privileges to root.

OFFSEC - Proving Grounds - CASSIOS

info@hekk.one — Thu, 27 Aug 2026 00:00:00 +0000

SMB share exposes recycler.ser; app source reveals credentials. Login enables ysoserial RCE, then PwnKit (CVE-2021-4034) escalates to root.

OFFSEC - Proving Grounds - ARIN

info@hekk.one — Tue, 25 Aug 2026 00:00:00 +0000

Port 43 WHOIS and an ARIN web app expose registered data. After signup, SMTP receives the link. RWHOIS manipulation and a Fail2Ban tilde escape enable RCE and root access.

OFFSEC - Proving Grounds - DEPTHB2R

info@hekk.one — Mon, 24 Aug 2026 00:00:00 +0000

Gobuster finds a JSP file on port 8080 enabling directory listing. Enumeration reveals SSH access as bill after disabling UFW. Initial access allows sudoing to root via bash.

OFFSEC - Proving Grounds - BORN2ROOT

info@hekk.one — Sun, 23 Aug 2026 00:00:00 +0000

Initial access is gained via an SSH key in icons. A cronjob is abused for a jimmy shell, then Hydra finds hadi’s reused password, enabling root access.

OFFSEC - Proving Grounds - NULLBYTE

info@hekk.one — Sun, 23 Aug 2026 00:00:00 +0000

Exiftool reveals a hidden directory. Hydra bypasses the key, SQL injection dumps a hash, which is cracked for SSH access. DirtyCow (CVE-2016-5195) is exploited to gain root.

OFFSEC - Proving Grounds - DECEPTION

info@hekk.one — Sat, 22 Aug 2026 00:00:00 +0000

WordPress enumeration revealed users and a hint leading to a split password. We combined it to gain SSH access, then exploited SUID /usr/bin/python2.7 to escalate privileges to root.

OFFSEC - Proving Grounds - FOWSNIFF

info@hekk.one — Sat, 22 Aug 2026 00:00:00 +0000

GitHub credentials enable POP3 access to retrieve an SSH password. Hydra finds valid credentials for SSH access. A writable cube.sh used by the MOTD is abused to gain root.

OFFSEC - Proving Grounds - LAZYSYSADMIN

info@hekk.one — Sat, 22 Aug 2026 00:00:00 +0000

SMB share access revealed WordPress credentials. After logging into WordPress, we achieved RCE and initial access. Reused togie’s password to gain sudo privileges and escalate to root.

OFFSEC - Proving Grounds - SCARECROW1.1

info@hekk.one — Sat, 22 Aug 2026 00:00:00 +0000

Used XXE and PHP wrappers to read files/source code, bypassed the upload blacklist with a PHP reverse shell for initial access, then exploited SUID find to escalate privileges to root.

OFFSEC - Proving Grounds - FIVE86.2

info@hekk.one — Fri, 21 Aug 2026 00:00:00 +0000

A WordPress site is compromised via brute-forced credentials and an exploited vulnerable plugin. Initial access is gained, then LinPEAS identifies PwnKit (CVE-2021-4034), enabling privilege escalation to root.

OFFSEC - Proving Grounds - PWNLAB

info@hekk.one — Fri, 21 Aug 2026 00:00:00 +0000

Exploited PHP wrappers/LFI to access DB credentials, extract web credentials, upload a malicious GIF/PHP reverse shell, gain access, then exploit DirtyCow (CVE-2016-5195) for root.

OFFSEC - Proving Grounds - CONFUSION

info@hekk.one — Thu, 20 Aug 2026 00:00:00 +0000

A Cacti HTTPS exploit is adapted for RCE. Database credentials enable lateral movement to james, who can modify /usr/local/sbin/systeminfo and run it as root via doas, enabling privilege escalation.

OFFSEC - Proving Grounds - FUXA

info@hekk.one — Thu, 20 Aug 2026 00:00:00 +0000

Fuxa v1.2.4-2188 is exposed on port 1881. A public exploit for the SCADA/HMI software provides remote code execution, allowing us to gain root access to the server.

OFFSEC - Proving Grounds - NEEDLE

info@hekk.one — Wed, 19 Aug 2026 00:00:00 +0000

Exploit on port 80 the contact form’s SVG upload function with a special HTTP header to access the medical dashboard. Abuse XSL_PATH during PDF discharge summary generation to inject a custom XSL file and achieve RCE.

OFFSEC - Proving Grounds - MEDITRACK

info@hekk.one — Tue, 18 Aug 2026 00:00:00 +0000

SQLi on port 9000 dumps creds. Crack meditrackDev for Gitea access. Find Flask secret to forge admin cookie, then import snapshot for Pickle RCE. Escalate to root via CVE-2026-41651.

OFFSEC - Proving Grounds - VANITY

info@hekk.one — Mon, 13 Oct 2025 00:00:00 +0000

Rsync on 873 shares web application source code, using cmd injection gains initial access. Abuse rsync cronjob with -e option to get root.

OFFSEC - Proving Grounds - POSTFISH

info@hekk.one — Sun, 12 Oct 2025 00:00:00 +0000

Website PostFish on port 80 and SMTP on port 25 reveal usernames. Hydra finds credentials, sending an email with a reset link grants brian access. Pwnkit (CVE-2021-4034) escalates to root.

OFFSEC - Proving Grounds - RUSSIANDOLLS

info@hekk.one — Sun, 12 Oct 2025 00:00:00 +0000

On port 8080 the website loads images via local http URLs, found open port 4242 with FILE VIEWER app. Path traversal exposes passwords and allows access via SSH. sudo v1.9.15 exploited for root access using CVE-2025-32463 chroot escalation.

OFFSEC - Proving Grounds - DEVELOP

info@hekk.one — Sat, 11 Oct 2025 00:00:00 +0000

Access Git repository on port 80 for credentials, login application on port 8080 and use command injection to retrieve a SSH key. Exploit CVE-2021-4034 to become root.

OFFSEC - Proving Grounds - PASSPORT

info@hekk.one — Sat, 11 Oct 2025 00:00:00 +0000

Access website on port 80, extract credentials, log into FTP. Crack Luigi’s SSH key and gain initial access. Move laterally to luca and attach to a root tmux session for privilege escalation.

OFFSEC - Proving Grounds - SYBARIS

info@hekk.one — Fri, 10 Oct 2025 00:00:00 +0000

FTP on port 21 allows anonymous login and is writable. Redis 5.0.9 on port 6379 is exploitable by uploading a Redis module via FTP and exploit Redis for pablo access, then use pwnkit (CVE-2021-4034) to escalate to root.

OFFSEC - Proving Grounds - DRIBBLE

info@hekk.one — Thu, 09 Oct 2025 00:00:00 +0000

Web application on port 3000 allows admin access via modified cookie. Exploit Sudo Baron Samedit (CVE-2021-3156) to gain root.

OFFSEC - Proving Grounds - LUNAR

info@hekk.one — Wed, 08 Oct 2025 00:00:00 +0000

Download zip from port 80, exploit PHP for LFI, use log poisoning for RCE as www-data. SSH with liam’s key for lateral movement and escalate to root via NFS no_root_squash.

OFFSEC - Proving Grounds - MARKETING

info@hekk.one — Sun, 05 Oct 2025 00:00:00 +0000

LimeSurvey 5.3.24 on port 80 has weak credentials, RCE gives www-data access. Find credentials and move laterally to t.miller, use sudo sync.sh to reach m.sander, then sudo to root.

OFFSEC - Proving Grounds - SPLODGE

info@hekk.one — Sun, 05 Oct 2025 00:00:00 +0000

Git repository on port 80 yields password via git-dumper. Login to admin panel on 8080, exploit preg_replace for initial access. Use pwnkit (CVE-2021-4034) to get root.

OFFSEC - Proving Grounds - SONA

info@hekk.one — Sun, 28 Sep 2025 00:00:00 +0000

Brute-force NEXUS admin password on port 23. Use credentials on port 8081 and using CVE-2020-10199 gives initial access. move laterally to sona and edit cronjob’s base64.py for root.

OFFSEC - Proving Grounds - AUDIO

info@hekk.one — Sat, 27 Sep 2025 00:00:00 +0000

Port 80 allows MP3/MPEG uploads. Upload MP3 with .php extension via BURP to get initial access. Find MySQL credentials reused by jason to move laterally. Run /usr/bin/git with sudo to gain root.

OFFSEC - Proving Grounds - ERP

info@hekk.one — Sat, 27 Sep 2025 00:00:00 +0000

webERP on port 80 with weak credentials. SQL injection (CVE-2019-13292) reveals inoERP application, exploited for www-data access. SSH forwarding to port 8443 uncovers monitorr 1.7.6 which we can exploit for root.

OFFSEC - Proving Grounds - HETEMIT

info@hekk.one — Sat, 27 Sep 2025 00:00:00 +0000

Werkzeug/1.0.1 on port 50000 has RCE endpoint, gain initial access as cmeeks. Edit /etc/systemd/system/pythonapp.service and use sudo to reboot the target to escalate to root.

OFFSEC - Proving Grounds - FLIMSY

info@hekk.one — Thu, 25 Sep 2025 00:00:00 +0000

OpenResty on port 43500 with APISIX/2.8 has RCE vulnerability (CVE-2022-24112). Exploit this and get initial access, write custom script in /etc/apt/apt.conf.d to escalate to root via cronjob.

OFFSEC - Proving Grounds - BANZAI

info@hekk.one — Sun, 21 Sep 2025 00:00:00 +0000

FTP on port 21 with weak credentials holds web dirirectory for port 8295. Upload PHP shell to gain initial access. MySQL UDF exploit sets SUID on bash and allows us to escalates to root.

OFFSEC - Proving Grounds - WHEELS

info@hekk.one — Sun, 21 Sep 2025 00:00:00 +0000

Wheels CarService website on port 80 has XPATH injection vulnerability which leads to gaining credentials for initial access. SUID on a binary with path traversal vulnerability to dump /etc/shadow. Crack hash with hashcat to gain root.

OFFSEC - Proving Grounds - BUNYIP

info@hekk.one — Sat, 20 Sep 2025 00:00:00 +0000

S3cur3 r3pl application on port 8000 is vulnerable to MD5 length extension, exploiting this gives initial access. Pwnkit (CVE-2021-4034) escalates to root.

OFFSEC - Proving Grounds - WOMBO

info@hekk.one — Sat, 20 Sep 2025 00:00:00 +0000

Redis 5.0.9 on port 6379 has RCE vulnerability, exploiting it grants initial access as root user.

OFFSEC - Proving Grounds - GROOVE

info@hekk.one — Fri, 19 Sep 2025 00:00:00 +0000

ChurchCRM 4.5.1 on port 80 has weak credentials. Using an SQL injection via sqlmap reveals the root hash. Cracking it grants root access.

OFFSEC - Proving Grounds - SPAGHETTI

info@hekk.one — Fri, 19 Sep 2025 00:00:00 +0000

IRC server on port 6667, message to bot gives access to source code. Analyzing code gives code exeecution and initial access. Pwnkit exploit used to escalate to root.

OFFSEC - Proving Grounds - DEPLOYER

info@hekk.one — Thu, 18 Sep 2025 00:00:00 +0000

Anonymous FTP on port 21 gives site config and PHP code. Exploit LFI, drop PHP shell, gain initial access. Upload SSH key, use sudo docker build to get /opt/id_rsa.bak and escalate to root.

OFFSEC - Proving Grounds - CONVERTEX

info@hekk.one — Tue, 16 Sep 2025 00:00:00 +0000

XXE in web application on port 5000 and leaks gustavo SSH private key for initial access. Forward selenium port 4444 with chisel, exploit with Python script to gain root.

OFFSEC - Proving Grounds - MZEEAV

info@hekk.one — Sun, 14 Sep 2025 00:00:00 +0000

Web application on port 80 has a ZIP backup with source code. Upload PHP webshell via MZ magic byte check, gain initial access and escalate to root using renamed find binary in /opt/fileS.

OFFSEC - Proving Grounds - PAYDAY

info@hekk.one — Sun, 14 Sep 2025 00:00:00 +0000

INTERNETSHOP on port 80 uses CS-CART. Weak credentials allow login and RCE via template editor with PHP webshell. Gain patrick user access via weak credentials and escalate to root using sudo bash.

OFFSEC - Proving Grounds - PEPPO

info@hekk.one — Sun, 14 Sep 2025 00:00:00 +0000

Ident on port 113 reveals process owner eleanor on port 10000. SSH access via weak credentials to get initial access in rbash, escape rbash using ed, set PATH and exploit pwnkit (CVE-2021-4034) to gain root.

OFFSEC - Proving Grounds - ZENPHOTO

info@hekk.one — Sun, 14 Sep 2025 00:00:00 +0000

Website on port 80 runs ZENPHOTO 1.4.1.4, vulnerable to RCE exploit, granting www-data access. RDS Protocol LPE (CVE-2010-3904) escalates to root.

OFFSEC - Proving Grounds - SILICON

info@hekk.one — Sat, 13 Sep 2025 00:00:00 +0000

KORTEX ADVOCATED software on port 8000 which has SQLi vulnerability (CVE-2024-7640). Dump and crack hashes for initial access, escalate to root via ruby3.1.

OFFSEC - Proving Grounds - AIR

info@hekk.one — Fri, 12 Sep 2025 00:00:00 +0000

Aria2 WebUI on port 8888 is vulnerable to path traversal (CVE-2023-39141). Steal deathflash SSH key for initial access, find RPC key, forward port 6800 with chisel, configure app, upload SSH key to root for root access.

OFFSEC - Proving Grounds - CACTI

info@hekk.one — Fri, 12 Sep 2025 00:00:00 +0000

Cacti v1.2.28 on port 80 exploited via CVE-2025-24367 for webshell, gaining initial access as www-data. Found credentials in config.php, reused to escalate to root.

OFFSEC - Proving Grounds - HAWAT

info@hekk.one — Wed, 10 Sep 2025 00:00:00 +0000

Nextcloud runs on port 50080 with weak credentials and has a ZIP file with SQL-vulnerable application code. Abusing the SQL injection we get initial access as the root user.

OFFSEC - Proving Grounds - EDUCATED

info@hekk.one — Mon, 08 Sep 2025 00:00:00 +0000

WISDOM SCHOOL site on port 80 has Gosfem alogin page. RCE gives initial access. Crack msander’s hash, find emiller credentials in APK. Sudo escalates to root via bash.

OFFSEC - Proving Grounds - GRAPH

info@hekk.one — Sun, 07 Sep 2025 00:00:00 +0000

On port 80 is a graphql endpoint with SQL injection and gets hashes. Crack one for initial access. Python script with newline injection sets josh password. As josh, read /etc/shadow, crack root’s hash and escalate to root.

OFFSEC - Proving Grounds - PIER

info@hekk.one — Sun, 07 Sep 2025 00:00:00 +0000

Torrentpier on port 80 has a insecure object deserialization vulnerability (CVE-2024-1651) for RCE. Gain access as the pier user, use sudo to run bash as root.

OFFSEC - Proving Grounds - SORCERER

info@hekk.one — Sun, 07 Sep 2025 00:00:00 +0000

Zipfiles on port 7742 contain users home directories. A found id_rsa key allows scp only. Upload authorized_keys, gain SSH access, and use SUID binary to escalate to root.

OFFSEC - Proving Grounds - CHARLOTTE

info@hekk.one — Sat, 06 Sep 2025 00:00:00 +0000

Use credentials or mount shares for application code. Leak creds via nginx (80) using BURP. Exploit RCE as www-data. Deploy JS to abuse a cronjob and move laterally. Escalate to root with sudo/bash.

OFFSEC - Proving Grounds - CLIPPER

info@hekk.one — Sat, 06 Sep 2025 00:00:00 +0000

ClipBucketV5 on port 80 has RCE vulnerability (CVE-2025-21624). Gain initial access and reuse credentials for lateral movement, exploit sudo lsof to set LD_LIBRARY_PATH and create own .so file to escalate to root.

OFFSEC - Proving Grounds - FAIL

info@hekk.one — Fri, 05 Sep 2025 00:00:00 +0000

Upload SSH key via rsync for initial access. Abuse fail2ban’s actioncheck in iptables-multiport.conf and trigger it by failed SSH logins to escalate to root.

OFFSEC - Proving Grounds - TICO

info@hekk.one — Thu, 04 Sep 2025 00:00:00 +0000

Use OFFSEC SSH credentials for initial access or exploit NodeBB on 8080 (CVE-2020-15149) for admin access. Write SSH key to root’s authorized_keys to escalate to root.

OFFSEC - Proving Grounds - PHOBOS

info@hekk.one — Wed, 03 Sep 2025 00:00:00 +0000

Find svn directory on port 80, enumerate logs for hostname. Register user and exploit code for LFI/RCE and initial access, use pwnkit (CVE-2021-4034) or crack root SHA-512 from MongoDB to escalate to root.

OFFSEC - Proving Grounds - HUGS

info@hekk.one — Sun, 31 Aug 2025 00:00:00 +0000

SSH with provided creds or exploit HugeGraph 1.2.0 (CVE-2024-27348) on 8080 for initial acces. Get mesbaha credentials from rest-server.properties file and SSH laterally, exploit sudo /home/mesbaha/reporter.sh to root.

OFFSEC - Proving Grounds - SHIFTDEL

info@hekk.one — Sun, 31 Aug 2025 00:00:00 +0000

Access via provided credentials or exploit WordPress 4.9.6 (CVE-2019-17671) for a password. Delete .htaccess, and get credentials, use phpMyAdmin RCE (CVE-2018-12613) for initial access and exploit command misconfiguration to get root.

OFFSEC - Proving Grounds - DETECTION

info@hekk.one — Sat, 30 Aug 2025 00:00:00 +0000

Exploit RCE in changedetection v0.45.1 on port 5000 to gain initial access as the root user.

OFFSEC - Proving Grounds - FRACTAL

info@hekk.one — Sat, 30 Aug 2025 00:00:00 +0000

Exploit Symfony 3.4.46 on port 80 via /_fragment RCE for initial access. Use MySQL creds from proftpd to add benoit user, log in via FTP, add SSH key, and escalate to root with sudo.

OFFSEC - Proving Grounds - MANTIS

info@hekk.one — Sat, 30 Aug 2025 00:00:00 +0000

Gobuster finds /bugtracker with MantisBT 2.0. Exploit CVE-2017-12419 for MySQL credentials, crack a hash and get www-data via RCE. Mysqldump process runs with credentials and can be reused. Escalate using sudo.

OFFSEC - Proving Grounds - SYNAPSE

info@hekk.one — Fri, 29 Aug 2025 00:00:00 +0000

Synapse web app on port 80 allows SSI abuse via profile picture upload. Gain www-data access, crack GPG key to become mindsflee user, then use sudo synapse_commander.py with socat to escalate to root.

OFFSEC - Proving Grounds - COBBLES

info@hekk.one — Thu, 28 Aug 2025 00:00:00 +0000

Gain initial access via credentials or ZoneMinder exploit. As www-data, exploit HAProxy failover to access backup server as root in Docker. Escalate by copying bash to shared mount for host root access.

OFFSEC - Proving Grounds - SIROL

info@hekk.one — Wed, 27 Aug 2025 00:00:00 +0000

Exploit Kibana 6.5.0 (CVE-2019-7609) for initial access, then mount the host filesystem to get root or exploit glusterfs (CVE-2018-1088) to escalate to root via a created cronjob.

OFFSEC - Proving Grounds - OUTDATED

info@hekk.one — Tue, 26 Aug 2025 00:00:00 +0000

SSH or initial access by exploiting the website using mPDF 6.0 and downloading credentials, reuse creds for Webmin on port 10000 to escalate to root.

OFFSEC - Proving Grounds - BITFORGE

info@hekk.one — Sun, 24 Aug 2025 00:00:00 +0000

Git on port 80 leaks MySQL credentials. RCE in Simple Planning v1.52.01 for initial access, with pspy64 find jack’s credentials and changing flask script escalates to root.

OFFSEC - Proving Grounds - PYLOADER

info@hekk.one — Sun, 24 Aug 2025 00:00:00 +0000

Exploit CVE-2023-0297 on pyload (port 9666) via unauthenticated RCE to gain root access.

OFFSEC - Proving Grounds - RUBYDOME

info@hekk.one — Sun, 24 Aug 2025 00:00:00 +0000

Access target via SSH or exploit CVE-2022-25765 on port 3000. Gain initial access as the andrew user, escalate to root via sudo ruby script.

OFFSEC - Proving Grounds - BOOLEAN

info@hekk.one — Sat, 23 Aug 2025 00:00:00 +0000

Login screen can be bypassed via register JSON tweak and provides access remi’s .ssh directory. Upload our own SSH key for initial access and get root’s private key for privilege escalation.

OFFSEC - Proving Grounds - LAVITA

info@hekk.one — Fri, 22 Aug 2025 00:00:00 +0000

SSH in or exploit Laravel 8.4.0 with APP_DEBUG is set to true to gain www-data access. Abuse skunk’s script to escalate to skunk and use sudo /usr/bin/composer to edit composer.json to escalate privileges.

OFFSEC - Proving Grounds - PLUM

info@hekk.one — Thu, 21 Aug 2025 00:00:00 +0000

PluXml on port 80 uses weak credentials. Edit page to add PHP reverse shell for initial access. Find root password in /var/mail/www-data.

OFFSEC - Proving Grounds - VMDAK

info@hekk.one — Wed, 20 Aug 2025 00:00:00 +0000

Prison management system on port 9443 vulnerable to SQL injection & RCE once initial access got MySQL creds and SSH in. Using port forward on 8080 we can exploit Jenkins (CVE-2024-23897) for root.

OFFSEC - Proving Grounds - BLACKGATE

info@hekk.one — Mon, 18 Aug 2025 00:00:00 +0000

Redis 4.0.14 on port 6379 exploited for initial access. linpeas.sh reveals pwnkit vulnerability (CVE-2021-4034) which leads to privilege escalation.

OFFSEC - Proving Grounds - IMAGE

info@hekk.one — Mon, 18 Aug 2025 00:00:00 +0000

ImageMagick 6.9.6-4 on port 80 exploited for initial access. SUID on the strace binary leads to root privilege escalation.

OFFSEC - Proving Grounds - SPX

info@hekk.one — Mon, 18 Aug 2025 00:00:00 +0000

Tiny File Manager 2.5.3 on port 80; Exploiting CVE-2024-42007 and uploaded PHP reverse shell gives initial access, making own Makefile to set SUID on /bin/bash escalates our privileges

OFFSEC - Proving Grounds - OCHIMA

info@hekk.one — Sun, 17 Aug 2025 00:00:00 +0000

Maltrail 0.52 on port 8338 allows unauthenticated RCE, granting initial access. Exploit /var/backups/etc_Backup.sh as it’s run by root every minute, to escalate to root privileges.

OFFSEC - Proving Grounds - ZIPPER

info@hekk.one — Sun, 17 Aug 2025 00:00:00 +0000

Zipper website on port 80 allows file uploads. Use ZIP PHP wrapper for initial access and escalate to root via /opt/backup.sh script.

OFFSEC - Proving Grounds - SCRUTINY

info@hekk.one — Sat, 16 Aug 2025 00:00:00 +0000

Initial access via OFFSEC credentials or TeamCity CVE-2024-27198 exploit, get id_rsa key for marcot and password of multiple users. Briand runs /usr/bin/systemctl as root, escalate to root using GTFOBins.

OFFSEC - Proving Grounds - TWIGGY

info@hekk.one — Sat, 16 Aug 2025 00:00:00 +0000

SaltStack on port 8000 is vulnerable for CVE-2020-11651 & CVE-2020-11652 RCE exploit, enabling root reverse shell access.

OFFSEC - Proving Grounds - WORKAHOLIC

info@hekk.one — Sat, 16 Aug 2025 00:00:00 +0000

Use OFFSEC creds or scan Wordpress. Exploit a Wordpress vulnerability (CVE-2024-9796), crack hashes for charlie/ted. FTP as ted and SSH in as charlie. Escalate to root via SUID binary with custom shared object.

OFFSEC - Proving Grounds - CLUE

info@hekk.one — Fri, 15 Aug 2025 00:00:00 +0000

Remote file read on Cassandra Web (port 3000) exposes cassie credentials. RCE via FreeSwitch (8021). As cassie, run cassandra-web as root, get a RSA key and login as root.

OFFSEC - Proving Grounds - EXTPLORER

info@hekk.one — Fri, 15 Aug 2025 00:00:00 +0000

eXtplorer application on port 80 with weak credentials which allows PHP reverse shell. As www-data, we can’t read local.txt. Crack dora’s hash, switch to dora in disk group, read proof.txt.

OFFSEC - Proving Grounds - FLU

info@hekk.one — Fri, 15 Aug 2025 00:00:00 +0000

Atlassian Confluence 7.13.6 on port 8090 has CVE-2022-26134 exploit for initial access. Add reverse shell to script for root privileges.

OFFSEC - Proving Grounds - PRESS

info@hekk.one — Fri, 15 Aug 2025 00:00:00 +0000

FlatPress on port 8089 allows login with weak credentials, PHP reverse shell upload via GIF magic byte, and privilege escalation to root using sudo apt-get.

OFFSEC - Proving Grounds - CODO

info@hekk.one — Thu, 14 Aug 2025 00:00:00 +0000

Codoforum on port 80 uses weak credentials. Exploit CVE-2022-31854 to upload malicious PHP logo, gain initial access and find root password in /var/www/html.

OFFSEC - Proving Grounds - CRANE

info@hekk.one — Thu, 14 Aug 2025 00:00:00 +0000

SuiteCRM on port 80 has weak admin:admin credentials. Use CVE-2022–23940 for RCE, then escalate to root via sudo /usr/sbin/service

OFFSEC - Proving Grounds - FIRED

info@hekk.one — Thu, 14 Aug 2025 00:00:00 +0000

OpenFire 4.7.3 on port 9090 is vulnerable to CVE-2023-32315. Exploit and upload a .jar plugin for RCE. Root password found in script file to escalate privileges.

OFFSEC - Proving Grounds - HUB

info@hekk.one — Thu, 14 Aug 2025 00:00:00 +0000

FuguHub 8.4 on port 8082 is vulnerable to RCE exploit (CVE-2024-27697), granting direct root access.

OFFSEC - Proving Grounds - JORDAK

info@hekk.one — Tue, 12 Aug 2025 00:00:00 +0000

Jorani v1.0.0 on port 80 vulnerable to CVE-2023-26469, allows path traversal and code execution. User jordak has sudo access to /usr/bin/env, enabling root privilege escalation.

OFFSEC - Proving Grounds - LAW

info@hekk.one — Mon, 04 Aug 2025 00:00:00 +0000

Exploit CVE-2022-35914 on htmLawed 1.2.5 (port 80) with curl for RCE, get www-data shell. Pspy finds root script owned by www-data, run every minute. Add reverse shell, wait for root shell.

OFFSEC - Proving Grounds - WALLA

info@hekk.one — Sun, 03 Aug 2025 00:00:00 +0000

WFUZZ login credentials on port 8091, exploited RaspAP 2.5, CVE-2020-24572, then gained root via PwnKit.

OFFSEC - Proving Grounds - SNOOKUMS

info@hekk.one — Sun, 27 Jul 2025 00:00:00 +0000

PHP Gallery v0.8 has a RFI flaw. Use PHP shell, get michael’s MySQL creds, SSH in, find writable /etc/passwd via linpeas, set root password with OpenSSL and gain root.

OFFSEC - Proving Grounds - ASTRONAUT

info@hekk.one — Tue, 22 Jul 2025 00:00:00 +0000

SSH with provided credentials or exploit GravCMS on port 80. Use SUID bit on php7.4 binary to escalate to root.

OFFSEC - Proving Grounds - QUACKERJACK

info@hekk.one — Tue, 22 Jul 2025 00:00:00 +0000

rConfig on port 8081 has SQLi leaking admin hash. CrackStation decrypts it for credentials. CVE-2019-19509 grants access. SUID find binary escalates to root.

OFFSEC - Proving Grounds - BRATARINA

info@hekk.one — Mon, 21 Jul 2025 00:00:00 +0000

SSH access with OFFSEC credentials or exploit OpenSTMPD on port 25 for remote code execution as root.

OFFSEC - Proving Grounds - APEX

info@hekk.one — Sun, 20 Jul 2025 00:00:00 +0000

Exploit filemanager vuln on port 80 for OpenEMR SQL creds. Login to MySQL, get admin hash for app access. Use app exploit for initial access, reuse password for root escalation.

OFFSEC - Proving Grounds - NUKEM

info@hekk.one — Sun, 20 Jul 2025 00:00:00 +0000

Access target via SSH or exploit WordPress with wpscan using simple-file-list vuln. Get http user, find commander creds in wp-config.php, use SUID dosbox for root.

OFFSEC - Proving Grounds - PC

info@hekk.one — Sun, 20 Jul 2025 00:00:00 +0000

SSH or browser terminal on port 8000 for initial access. Escalate privileges via RPC server running as root using Python exploit script (CVE-2022-35411) to gain root access.

OFFSEC - Proving Grounds - LEVRAM

info@hekk.one — Sat, 19 Jul 2025 00:00:00 +0000

Port 8000 redirects to GERAPY v0.9.7 login. Use default credentials for access. Auth RCE grants initial access. /usr/bin/python3.10 with cap_setuid=ep gives root.

OFFSEC - Proving Grounds - NIBBLES

info@hekk.one — Sat, 19 Jul 2025 00:00:00 +0000

PostgreSQL port open, default creds allow login. Command execution (9.3+) runs reverse shell for access. SUID find enables root escalation.

OFFSEC - Proving Grounds - EXFILTRATED

info@hekk.one — Thu, 17 Jul 2025 00:00:00 +0000

SSH or Subrion CMS 4.2.1 file upload for access. Run linpeas to find CVE-2021-4034 (PwnKit) & cronjob with exiftool (CVE-2021-22204) for root.

OFFSEC - Proving Grounds - COCKPIT

info@hekk.one — Tue, 15 Jul 2025 00:00:00 +0000

SQL inject login to get admin & additional creds. Use credentials in Ubuntu Web Console. Exploit sudo tar wildcard to escalate to root.

OFFSEC - Proving Grounds - PELICAN

info@hekk.one — Mon, 14 Jul 2025 00:00:00 +0000

Exploitable Exhibitor for ZooKeeper on port 8080. Initial access user has gcore sudo privileges, can dump password-store process to reveal root credentials.

OFFSEC - Proving Grounds - ZINO

info@hekk.one — Sun, 13 Jul 2025 00:00:00 +0000

Access server with SMB file and use a Python exploit for PHP webshell in Booked Scheduler. Escalate to root via cronjob.