Writeups

Please visit https://yufongg.github.io instead

Machines:

#	Platform	Machines
1	TryHackMe	bufferOverflowPrep, Brainstorm, brainpan, gatekeeper, dailyBugle, gameZone, internal, overpass2, skynet, theMarket, Alfred, Blue, HackPark, Relevant, Steelmountain
2	Buffer Overflow Practice	freeFloatFTP, dostackbufferoverflowgood, vulnserver-TRUN

Vulnhub TJ Null's List (Not Completed Yet)

Box	Steps/Hints to Root
Symfonos 1	SMB Fileshare Bruteforce Wordpress (Plugin Exploit LFI) SUID Binary (Path Hijacking)
Symfonos 2	SMB + FTP Exploit CMS Exploit (RCE) Sudo (GTFO Bin)
Symfonos 3	Hidden Dir (/underworld) Shellshock Cronjob + TCPDump Cronjob + Python Hijacking
Symfonos 4	Compile exploits to root
Symfonos 5.2	Compile exploits to root
Kioptrix - L1	Compile exploits to root
Kioptrix - L2	SQLi Auth Bypass Command Injection Kernel Exploit
Kioptrix - L3	CMS Exploit Creds Found in Linux Buffer Overflow/Sudo/Kernel Exploit/
Kioptrix - L4	SQLi Auth Bypass Escape Jail Shell SQL running as Root
Kioptrix - L5	CMS Exploit (LFI) CMS Exploit (RCE) Kernel Exploit
DC 6	Wordpress (Plugin) Creds Found in Linux Sudo Sudo
DC 9	SQLi Database Enum Bruteforce HTTP Form LFI Port Knocking Bruteforce SSH Sudo
Troll 1	FTP anon Wireshark Bruteforce SSH Cronjob/Kernel Exploit
Troll 2	FTP w/ Obvious Creds Image Forensics Bruteforce Zip SSH + Jailshell 32 Bit Buffer Overflow
Troll 3	FTP w/ Obvious Creds Image Forensics Bruteforce Zip SSH + Jailshell 32 Bit Buffer Overflow
PwnOSv2	SQLi Insert Webshell/CMS Exploit Creds Found in Linux
PwnLab	LFI File Upload + Bypass SUID Binary (Path Hijacking) SUID Binary (Command Injection)
SickOS	HTTP PUT Vulnerable Binary
Temple Of Doom	Web App Exploit Vulnerable Binary Sudo (GTFO Bin)
Vulnix	SMTP Username Enum SSH Bruteforce NFS Fileshare no_root_squash
Web Developer	Wireshark Wordpress (Upload Reverse Shell) Creds Found in Linux Sudo (GTFO Bin)
Zico2	CMS Exploit Creds Found in Linux Creds Found in Linux Sudo (GTFO Bin)
SkyTower	SQLi Auth Bypass + WAF Bypass Proxychains (Open up SSH) Creds Found in Linux Sudo
Fristileaks	Hidden Dir (/fristi) HTML Hidden Text File Upload + Bypass Cronjob Reverse Engineering Password Sudo
LinSecurity	NFS Fileshare Sudo (GTFO Bin)/SUID Binary (GTFO Bin)/Docker/systemd
PinkysPalacev2	Hidden Dir (/secret) Port Knocking Bruteforce (cewl wordlist) Bruteforce SSH key SUID Binary Cronjob 64 Bit Buffer Overflow
Solid State 1	Service Exploit Cronjob
Escalate_Linux	Enumerate Users (SMB) HTTP RCE no_root_squash/SUID Binary (Path Hijacking)/SUID Binary
Wintermute	Hidden Dir (/turing-bolo) LFI SUID Binary Pivot CMS Exploit LXD/Kernel Exploit
Born2Root	Hidden Dir (/icons) Cronjob Bruteforce SSH Reused Creds
Stapler1	Wordpress (Plugin)/(Bruteforce)/ Bruteforce FTP Creds Found in Linux/Cronjob/Kernel Exploit
Digitalworld.local(Bravery)	Enumerate Users (SMB) Create Wordlist Bruteforce SMB Fileshare HTTP Dir Enum CMS Exploit no_root_squash/Cronjob/SUID Binary (GTFO Bin)
Digitalworld.local(Development)-notdone
Digitalworld.local(FALL)-notdone
Digitalworld.local(JOY)-notdone
Digitalworld.local(Mercy v2)-notdonee
DerpNStink	Wordpress (Bruteforce + Plugin) Creds Found in Linux Wireshark Sudo
RickdiculouslyEasy	Hidden Dir (passwords) Command Injection + Bypass Bash Bruteforce SSH Creds Found in Linux + additonal stuff
Sar1	Web App Exploit Cronjob
Djinn	FTP anon Command Injection + Bypass Bash Creds Found in Linux Sudo/Python2 Input Vuln/Decompile Python2 file
EVM1	Wordpress (Upload Reverse Shell) Creds Found in Linux
HackMe	SQLi Database Enum SUID Binary
Tommy Boy 1	Hidden Web Dir (/prehistoricforest) Image Forensic Crack Hash Hidden Web Dir (/spanky) Bruteforce FTP Hidden Web Dir (/NickIzL33t) Edit User-Agent Generate password word list Bruteforce zip Wordpress (Bruteforce) Edit/Update mysql credentials Wordpress (Upload Reverse Shell)
Breach 1	Hidden text Decode String Crack Hash Hidden Webpage (Click Image) Image Forensic (exiftool) Fuzz Search Decrypt SSL traffic Hidden Web Dir (/_M@nag3Me/html) Upload reverse shell Creds Found in Linux Image Forensic From Earlier Sudo (GTFO Bin)
Tiki 1	SMB Fileshare Enum CMS Exploit Sudo
Prime 1	Hidden Dir (/secret.txt, /image.php, /index.php) Enumerate parameters in .php files LFI Wordpress (Upload Reverse Shell) Sudo + Creds Found in Linux + Ciphertext Sudo/Kernel Exploit
Bob 1.0.1	Command Injection + Bypass Bash Creds Found in Linux Sudo
DevGuru 1	Hidden Web Dir (.git) Creds Found in (.git) CMS Exploit (RCE) Creds Found in Linux (.bak) CMS Exploit (RCE) Sudo Version Exploit + Sudo (GTFO Bin)
W34KN3SS	Add entry to /etc/hosts SSL Version Exploit Decompile Python Binary Sudo
Lord of the Root 1.0.1	Port Knocking SQLi Database Enum MySQL running as root/Kernel Exploit/Buffer Overflow
Glasglow Smile 1.1	Bruteforce (Cewl Wordlist) Joomla (Upload Reverse Shell) Creds Found in Linux Ciphertext Password Protected Zipfile Cronjob
GoldenEye 1	Hidden Text Bruteforce (POP3) Hidden Web Dir (/gnocertdir) Bruteforce (POP3) CMS Exploit (RCE) Kernel Exploit
Toppo 1	Web Rabbit Hole SUID Binary (GTFO Bin)
Hack Me Please 1	Hidden Text Hidden Dir (/seeddms51x/seeddms-5.1.22/) CMS Misconfiguration Update SQL Credentials CMS Exploit (RCE)
Healthcare 1	CMS Exploit (SQLi) CMS Exploit (RCE) SUID Binary (Path Hijacking)
Brainpan 1	Hidden Dir (/bin) Buffer Overflow Sudo (GTFO Bin)
Photographer 1	SMB Fileshare Enum CMS Exploit (File Upload) SUID Binary (GTFO Bins)
NullByte 1	Image Forensics SQLi Database Enum SUID Binary (Path Hijacking)