HackingClub on Jc de Matos https://jcdematos.com/tags/hackingclub/ Recent content in HackingClub on Jc de Matos Hugo en Thu, 08 Oct 2026 00:00:00 +0000 [Write-Up] HackingClub: Breakout https://jcdematos.com/writeups/breakout/ Thu, 08 Oct 2026 00:00:00 +0000 https://jcdematos.com/writeups/breakout/ Blind command injection in a web-based MD5 hashing tool, root inside a Docker container via SUID bash, then host root by mounting the underlying EBS volume. [Write-Up] HackingClub: Air https://jcdematos.com/writeups/air/ Tue, 06 Oct 2026 00:00:00 +0000 https://jcdematos.com/writeups/air/ RCE in Apache Airflow 1.10.10 via a known example DAG exploit (CVE-2020-11978), root inside the container via SUID bash, then host root through mounting the underlying EBS block device. [Write-Up] HackingClub: Easy Notes https://jcdematos.com/writeups/easynotes/ Sun, 04 Oct 2026 00:00:00 +0000 https://jcdematos.com/writeups/easynotes/ IDOR and stored XSS in a notes app via predictable MD5 note IDs, pivoting through a leaked admin credential and an unrestricted file upload for RCE, then root via a world-writable cron backup script. [Write-Up] HackingClub: Medicated https://jcdematos.com/writeups/medicated/ Fri, 02 Oct 2026 00:00:00 +0000 https://jcdematos.com/writeups/medicated/ Exposed backup zip files leak an SSH key restricted to scp-only, bypassed by overwriting authorized_keys, then root via a PATH hijack on a cron job’s run-parts call. [Write-Up] HackingClub: Fuel https://jcdematos.com/writeups/fuel/ Wed, 23 Sep 2026 00:00:00 +0000 https://jcdematos.com/writeups/fuel/ SQL injection in FuelCMS leading to RCE, pivoting through a Chisel tunnel to an internal Jenkins instance, then root via passwordless sudo on perl. [Write-Up] HackingClub: Poisoning https://jcdematos.com/writeups/poisoning/ Sun, 20 Sep 2026 00:00:00 +0000 https://jcdematos.com/writeups/poisoning/ Apache access-log poisoning via a User-Agent header LFI for RCE, then root through a cap_setuid-capable Python binary. [Write-Up] HackingClub: DevOps https://jcdematos.com/writeups/devops/ Wed, 16 Sep 2026 00:00:00 +0000 https://jcdematos.com/writeups/devops/ Remote code execution through Terraform’s local-exec provisioner, escalated to root via passwordless sudo on ansible-playbook. [Write-Up] HackingClub: Editor https://jcdematos.com/writeups/editor/ Sun, 13 Sep 2026 00:00:00 +0000 https://jcdematos.com/writeups/editor/ RCE through a Jamovi R code execution endpoint for a Docker container root, then a Python sandbox escape against a host-reachable service to reach the host’s root. [Write-Up] HackingClub: Cache https://jcdematos.com/writeups/cache/ Sat, 12 Sep 2026 00:00:00 +0000 https://jcdematos.com/writeups/cache/ Redis misconfiguration with unauthenticated access, exploited to write a webshell, then root via a second internal Redis instance running as root. [Write-Up] HackingClub: Calc https://jcdematos.com/writeups/calc/ Sat, 12 Sep 2026 00:00:00 +0000 https://jcdematos.com/writeups/calc/ Command injection via a PHP eval() in a calculator endpoint, leading to RCE, credential reuse for a user shell, and root through a writable Python library hijack. [Write-Up] HackingClub: Lion https://jcdematos.com/writeups/lion/ Thu, 10 Sep 2026 00:00:00 +0000 https://jcdematos.com/writeups/lion/ SQL injection in a search endpoint used to write a webshell, then root via a world-writable cron backup script. [Write-Up] HackingClub: Reader https://jcdematos.com/writeups/reader/ Wed, 02 Sep 2026 00:00:00 +0000 https://jcdematos.com/writeups/reader/ SSRF/RFI chaining through an internal-only service for RCE, then root via a cap_setuid-capable perl binary.