SwagShop

Gaining Access

Nmap scan:

We have to add swagshop.htb to our /etc/hosts file to access port 80.

Magento Shop

This is whatwe see when we view port 80:

This is running an outdated version of Magento shop, and we can easily find exploits for it. The exploit here would change admin password of the site via SQL Injection:

Magento-Shoplift-SQLI/poc.py at master · joren485/Magento-Shoplift-SQLIGitHub

Then we can grab a publicly available RCE exploit from ExploitDB:

Magento CE < 1.9.0.1 - (Authenticated) Remote Code ExecutionExploit Database

This would require 3 fields, and we have 3 of them:

We can visit /app/etc/local.xml to find the date required:

Then, we can easily gain a reverse shell by using the PoC.

Privilege Escalation

I don't have any screenshots of this in my archive for some reason...weird. Checking sudo privileges for this reveals we can use vi as root.

We can follow GTFOBins and run this to spawn a root shell:

sudo vi /var/www/html/a -c ':!/bin/sh'