MySchool | VulnHub | Walkthrough

Описание: We start by finding two HTTP ports. The lower port is running CMSMS having version 2.2.14 which is vulnerable to an authenticated file upload vulnerability (unfortunately, we do not have creds for that). The high port reveals a wordpress setup page. We then set up a database for wordpress in our local box and connect it to the remote wordpress installation instance. Then we create an admin user for wordpress and log in to get a shell as www-data. We get hardcoded password for the user from CMSMS config file. The user can run a command-line file-management tool for cloud, rclone, as root. With this we modify the /etc/passwd file to include sha-512 hashed password of our choice for root. Now, just need to switch user to root.