> ## Documentation Index
> Fetch the complete documentation index at: https://rootea.es/llms.txt
> Use this file to discover all available pages before exploring further.

# Overflow

> Writeups verificados de la máquina Overflow de Hack The Box

# Overflow

<p className="machine-summary"><span className="prompt"><code>\$ tldr</code></span> Padding oracle + SQLi → Exiftool RCE → DNS hijack cron + BOF</p>

<div className="machine-meta">
  | ·                 | ·                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
  | ----------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
  | Sistema operativo | Linux                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
  | Dificultad        | Difícil                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
  | Vector            | <span className="vbadge vbadge-binary-exploitation">Binary</span>                                                                                                                                                                                                                                                                                                                                                                                                                 |
  | IP                | `10.10.11.119`                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
  | Fecha de retirada | 2022-04-09                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
  | Skills            | Padding Oracle Attack (Padbuster) Padding Oracle Attack (Bit Flipper Attack - BurpSuite) \[EXTRA] Cookie Hijacking SQL Injection (Generic UNION query) - Error Based Breaking Password Upload File - Abusing Exiftool (RCE) DNS Hijacking (Abusing Cron Job) Ghidra Binary Analysis Reversing Code (Computing valid PIN) Buffer Overflow (Controlling the program and manipulating its flow to desired functions) Abusing Decryption Function (XOR Trick) \[Privilege Escalation] |
</div>

## Writeups

| Idioma  | Autor                    | Formato | Enlace                                                       |
| ------- | ------------------------ | ------- | ------------------------------------------------------------ |
| 🇪🇸 ES | **S4vitar**              | Vídeo   | [Abrir](https://www.youtube.com/watch?v=tEbBDlOFen0)         |
| 🇪🇸 ES | **El Pingüino de Mario** | Vídeo   | [Abrir](https://www.youtube.com/watch?v=iMPKsR6ln_s)         |
| 🇬🇧 EN | **0xdf**                 | Texto   | [Abrir](https://0xdf.gitlab.io/2022/04/09/htb-overflow.html) |
| 🇬🇧 EN | **IppSec**               | Vídeo   | [Abrir](https://www.youtube.com/watch?v=4d87D4zFMEg)         |

## Recursos por skill

Documentación curada para cada técnica que aparece en la columna *Skills* de arriba. Fuentes: HackTricks, GTFOBins, PortSwigger, etc.

| Skill                       | Fuente      | Enlace                                                                                 |
| --------------------------- | ----------- | -------------------------------------------------------------------------------------- |
| Buffer Overflow (BoF / ROP) | HackTricks  | [Abrir](https://book.hacktricks.wiki/en/binary-exploitation/stack-overflow/index.html) |
| SQL Injection               | HackTricks  | [Abrir](https://book.hacktricks.wiki/en/pentesting-web/sql-injection/index.html)       |
| SQL Injection               | PortSwigger | [Abrir](https://portswigger.net/web-security/sql-injection)                            |
| Remote Code Execution (RCE) | HackTricks  | [Abrir](https://book.hacktricks.wiki/en/pentesting-web/command-injection.html)         |

## Skills relacionadas que conviene dominar

Cross-Site Scripting (XSS) · Local File Inclusion (LFI) · Remote File Inclusion (RFI) · Shellshock (CVE-2014-6271)

## Si te gustó esta máquina, prueba

* [Europa](/htb/machines/linux/medio/europa) — Linux, Medio
* [Bastard](/htb/machines/windows/medio/bastard) — Windows, Medio
* [Buff](/htb/machines/windows/facil/buff) — Windows, Fácil
* [Ellingson](/htb/machines/linux/dificil/ellingson) — Linux, Difícil
* [Flujab](/htb/machines/linux/dificil/flujab) — Linux, Difícil

***

## Comentarios y truquillos

¿Algo no funcionó del writeup oficial? ¿Has encontrado un truco mejor? Compártelo aquí — los comentarios viven en [GitHub Discussions](https://github.com/FFuson/HTB_Writeups/discussions).

<div className="rootea-giscus-wrap" data-giscus-term="machine:overflow" data-giscus-lang="es" />

*Última actualización: 2026-06-07*

<script type="application/ld+json">
  {`{"@context":"https://schema.org","@type":"TechArticle","headline":"Overflow — HTB Writeup Index","name":"Overflow","url":"https://rootea.es/htb/machines/linux/dificil/overflow","inLanguage":"es","datePublished":"2022-04-09","dateModified":"2026-06-07","about":{"@type":"Thing","name":"Hack The Box (HTB)"},"keywords":"Buffer Overflow (BoF / ROP), SQL Injection, SQL Injection, Remote Code Execution (RCE)","isPartOf":{"@type":"WebSite","name":"rootea.es","url":"https://rootea.es"},"author":{"@type":"Organization","name":"rootea.es"},"proficiencyLevel":"Difícil"}`}
</script>

<script type="application/ld+json">
  {`{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Inicio","item":"https://rootea.es"},{"@type":"ListItem","position":2,"name":"Linux","item":"https://rootea.es/htb/machines/linux/dificil/index"},{"@type":"ListItem","position":3,"name":"Difícil","item":"https://rootea.es/htb/machines/linux/dificil/index"},{"@type":"ListItem","position":4,"name":"Overflow","item":"https://rootea.es/htb/machines/linux/dificil/overflow"}]}`}
</script>