reading list
HackSmarter: 1 Sep Release
This is a list of HackSmarter Labs that I Released their blogs on Aug 23
10 articles
HackSmarter: Walnut
Walnut is a Linux machine rated Easy that covers OpenLDAP description leak, SSH as automation, hidden md5 hash file analysis, localjob3 pivot, ACL abuse on /etc/exports, NFS no_root_squash mount and SUID escalation
HackSmarter: SysAdmins
Leaked Pastebin passwords via anonymous FTP, brute-forced SNMPv3 as waserby to dump process memory via snmpwalk, hijacked a leaked sshpass password for helena, then exploited sudo 1.9.16p2 (CVE-2025-32463) to root on SysAdmins.
HackSmarter: Exception
Exception is a Linux machine rated Medium that covers hidden Rocket.Chat 3.12.1 discovery, CVE-2021-22911/CVE-2021-22910 NoSQL injection via $where to leak password reset token and totp secret, TOTP 2FA bypass with oathtool, Rocket.Chat webhook RCE to Docker shell as rocketchat, database credential reuse to Ron, and sudo nano escape via check_log --clean to root.
HackSmarter: GitOops
gitoops is a Linux machine rated Medium that covers Gitea enumeration, Terraform tfstate exposure via git history, unauthenticated S3 bucket, SSH private key recovery, Atlantis webhook abuse, and Terraform local-exec privilege escalation
HackSmarter: Staged
Leveraging a php webshell to stage a Sliver payload, abusing SeImpersonatePrivilege with EfsPotato to get SYSTEM, dumping and cracking ntlm hashes, then pivoting via socks5/Ligolo to the internal MySQL server to retrieve the flag from hacksmarter_db.
HackSmarter: Talisman
Talisman is a Linux machine rated Medium that covers CloudBeaver, Oracle enumeration, CREATE DIRECTORY abuse, UTL_FILE and DBMS_XSLPROCESSOR file read, SSH private key recovery, and SUID via writable root.sh
HackSmarter: BankSmarter
BankSmarter is a Linux machine rated Medium that covers SNMP enumeration with public community string, SSH, scheduled task abuse via writable backup script, UNIX domain socket via pty_server.py, and SUID PATH hijacking through env
HackSmarter: PivotSmarter
PivotSmarter is a basic lab that covers pivoting and tunneling.
HackSmarter: Ascension
Ascension is a Linux machine rated Easy that covers Anonymous FTP, NFS mount, SSH private key passphrase cracking, WordPress wp-config disclosure, MySQL credential dump, and cap_setuid Python privilege escalation
HackSmarter: Dark
Dark is a Linux machine rated Easy that covers WordPress enumeration, CVE-2026-23550 auth bypass, malicious plugin RCE, Docker breakout via host mount | WordPress, WPScan, CVE-2026-23550, Modular Connector, Plugin RCE, Docker, Chroot