# SwagShop

## Gaining Access

Nmap scan:

<figure><img src="/files/IjscjyYqIdPlOa05N62v" alt=""><figcaption></figcaption></figure>

We have to add `swagshop.htb` to our `/etc/hosts` file to access port 80.

### Magento Shop

This is whatwe see when we view port 80:

<figure><img src="/files/azKH69evleN6aCktLTV3" alt=""><figcaption></figcaption></figure>

This is running an outdated version of Magento shop, and we can easily find exploits for it. The exploit here would change admin password of the site via SQL Injection:

{% embed url="<https://github.com/joren485/Magento-Shoplift-SQLI/blob/master/poc.py>" %}

<figure><img src="/files/hTCwWfyCjWenLC6QMKlU" alt=""><figcaption></figcaption></figure>

Then we can grab a publicly available RCE exploit from ExploitDB:

{% embed url="<https://www.exploit-db.com/exploits/37811>" %}

This would require 3 fields, and we have 3 of them:

<figure><img src="/files/AGbRiHdryn8dSUgoG1Fw" alt=""><figcaption></figcaption></figure>

We can visit `/app/etc/local.xml` to find the date required:

<figure><img src="/files/A2OHzWm8inkCMeVQ1FXy" alt=""><figcaption></figcaption></figure>

Then, we can easily gain a reverse shell by using the PoC.

## Privilege Escalation

I don't have any screenshots of this in my archive for some reason...weird. Checking `sudo` privileges for this reveals we can use `vi` as root.

We can follow GTFOBins and run this to spawn a root shell:

```
sudo vi /var/www/html/a -c ':!/bin/sh'
```


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://rouvin.gitbook.io/ibreakstuff/writeups/hackthebox/easy/swagshop.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.