infraProeasy

Секретный кабинет (Secret Cabinet)

hackerlab

Task: Pentest machine with web login form and SSH access. Solution: SQL injection in hidden username field to bypass auth, SQLMap to dump MD5 hashes, crack password, SSH access, then GTFOBins sudo zip privilege escalation to read root flag.

$ ls tags/ techniques/
sql_injectionmysqlphpauthentication_bypasssudo_privescsshmd5_crackinggtfobinssqlmapzip_privesc
MD5 hash cracking via online lookupSQL Injection authentication bypassSQLMap database enumerationGTFOBins sudo zip privilege escalation
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups