Nmap scan:
We have to add swagshop.htb to our /etc/hosts file to access port 80.
This is whatwe see when we view port 80:
This is running an outdated version of Magento shop, and we can easily find exploits for it. The exploit here would change admin password of the site via SQL Injection:
Then we can grab a publicly available RCE exploit from ExploitDB:
This would require 3 fields, and we have 3 of them:
We can visit /app/etc/local.xml to find the date required:
Then, we can easily gain a reverse shell by using the PoC.
I don't have any screenshots of this in my archive for some reason...weird. Checking sudo privileges for this reveals we can use vi as root.
We can follow GTFOBins and run this to spawn a root shell:
