Overflow

Verified writeups for the Overflow machine of Hack The Box

Overflow

$ tldr Padding oracle + SQLi → Exiftool RCE → DNS hijack cron + BOF

·	·
Operating system	Linux
Difficulty	Hard
Vector	Binary
IP	10.10.11.119
Retirement date	2022-04-09
Skills	Padding Oracle Attack (Padbuster) Padding Oracle Attack (Bit Flipper Attack - BurpSuite) [EXTRA] Cookie Hijacking SQL Injection (Generic UNION query) - Error Based Breaking Password Upload File - Abusing Exiftool (RCE) DNS Hijacking (Abusing Cron Job) Ghidra Binary Analysis Reversing Code (Computing valid PIN) Buffer Overflow (Controlling the program and manipulating its flow to desired functions) Abusing Decryption Function (XOR Trick) [Privilege Escalation]

Writeups

Language	Author	Format	Link
🇪🇸 ES	S4vitar	Vídeo	Open
🇪🇸 ES	El Pingüino de Mario	Vídeo	Open
🇬🇧 EN	0xdf	Texto	Open
🇬🇧 EN	IppSec	Vídeo	Open

Skill resources

Curated documentation for each technique listed in the Skills column above. Sources: HackTricks, GTFOBins, PortSwigger, etc.

Skill	Source	Link
Buffer Overflow (BoF / ROP)	HackTricks	Open
SQL Injection	HackTricks	Open
SQL Injection	PortSwigger	Open
Remote Code Execution (RCE)	HackTricks	Open

Related skills worth mastering

Cross-Site Scripting (XSS) · Local File Inclusion (LFI) · Remote File Inclusion (RFI) · Shellshock (CVE-2014-6271)

If you liked this machine, try

• Europa — Linux, Medium
• Bastard — Windows, Medium
• Buff — Windows, Easy
• Ellingson — Linux, Hard
• Flujab — Linux, Hard

---

Comments & tips

Did the official writeup not work? Found a smarter trick? Share it here — comments live in GitHub Discussions.

Last updated: 2026-06-07