HackingClub

10 entries · web

• Techscope hard 2026-02-04

  Git Exposed, PHP Object Injection in Yii2 Framework to achieve RCE and Command Injection via cron binary reading from world-writable config file (privesc).

• SynthLabs medium 2025-02-23

  Git Exposed, JWT modification, Command Injection with bypass, WordPress user create via PHP script using wp-load.php and RCE in WordPress by modifying the themes functions.php file.

• Guardian easy 2025-02-26

  Bypass Verification with SQL Injection, Code Review to get RCE and Reverse Engineering to get root via Path Hijacking (privesc).

• Vorfall easy 2025-01-30

  Broken Access Control, Path Traversal, Reverse Malware Engineering to get RCE and Sudo Exec Permission via smbclient (privesc)

• UHC V20 Final hard 2025-01-16

  LFI via PHP, change user to UHC using Prototype Pollution and File with Sudo Exec Permission via Node (privesc).

• Biscuit medium 2024-12-26

  Default Password, Type Juggling via Cookies, Insecure Desserialization in PHP with RFI and File with Sudo Exec Permission via Format String Python (privesc).

• Maldev easy 2024-12-11

  Git Exposed, Type Juggling, LFI and Cron Binary run-parts (/usr/local/sbin).

• KOF easy 2024-12-01

  SQL Injection, Hash Crack, Command Injection, Bash SUID and Docker Breakout/Escape.

• Lion easy 2024-11-15

  Union-based SQL injection, PHP webshell upload via SQLi, and cron job misconfiguration for privesc.

• Poisoning easy 2024-10-20

  LFI, log poisoning via User-Agent injection, and Linux capabilities exploitation.