Linux Exploitation Expert — HackTricks Training
Progress from binary exploitation fundamentals to advanced exploit development in Linux across user space, heap, ARM, kernel, and browser targets.
CTF categories
Highlighted writeups
CTF
Math Door
64-bit binary. Heap exploitation. Heap feng shui. Tcache poisoning.FILE structure attack
Recent HTB
HTB
Facts
Hack The Box. Linux. Easy machine. This machine has an outdated version of Camaleon CMS that is vulnerable to Local File Read. With this vulnerability we can read the private SSH key of a user, crack the passphrase and access the machine. Then, this user hassudo permissions to run command facter as root, which can be used to escalate privileges using a Ruby script
HTB
Interpreter
Hack The Box. Linux. Medium machine. This machine has a Mirth Connect instance that is vulnerable to Unauthenticated Remote Code Execution. After getting a reverse shell, we can find a database credentials and a hashed password inside. We must analyze how the hash is generated in order to crack it. Once we have the password, we can access via SSH and find out an internal webserver running asroot that has a code injection vullnerability in Python due to eval and f-strings, which allows us to escalate to root
HTB
Eighteen
Hack The Box. Windows. Easy machine. In this assumed-breach machine we have credentials for an exposed MSSQL service where we can impersonate another user and find a hashed password for the website hosted by the machine. This hash can be cracked to find a password. After enumerating users by brute forcing RIDs in MSSQL, we find that it is reused by a domain user and we get access via WinRM. There is a bad ACL configured to groupIT and we can use BadSuccessor to escalate privileges, after configuring a SOCKS proxy to access required AD services
HTB
Dog
Hack The Box. Linux. Easy machine. This machine hosts a CMS that exposes a Git repository. Once we dump the repository, we can find a username and a database password that can be reused to log in as administrator of the CMS. Here, we can install a new module to execute a PHP web shell and get a reverse shell on the machine. Although there are hashed passwords on the database, the same password can be reused for a system user. Finally, we are allowed to runbee as root using sudo, which will let us escalate privileges by running arbitrary PHP code
HTB
Titanic
Hack The Box. Linux. Easy machine. This machine has a Local File Read vulnerability where we can read sensitive files. There is a Gitea instance with some repositories and a Docker configuration that shows how Gitea files are shared in a volume mount. So, we can find hashed passwords on the Gitea SQLite database and crack them. With this, we gain access via SSH reusing credentials. After that, we find a script running asroot using a vulnerable version of ImageMagick where we can perform a library hijacking to get arbitrary code execution, as rootRecent IMC
IMC
IMC 2021, Problem 1
Let
- Prove that there is a unique real
matrix that satisfies the equation - Express
in terms of .
IMC
IMC 2020, Problem 1
Let
consists of letters, all of them are from the alphabet . contains an even number of letters . contains an even number of letters .