PayDay - Proving Grounds Practice
Enumeration
Nmap
Initial nmap scan revealed SSH, HTTP and some mail ports were open.
Web Enumeration
Visiting the website revealed it was CS-Cart website.
Later, I searched how to find CS-Cart version and found this post (https://forum.cs-cart.com/t/how-to-find-my-cs-cart-version/13327)
which explains all you need to do is add ?version to your website like this http://test.com/?version. So I did it and found out it was CS-Cart 1.3.3.
Exploitation
CS-Cart 1.3.3 LFI
This version was vulnerable to LFI via below URL.
http://<IP>/classes/phpmailer/class.cs_phpmailer.php?classes_dir=../../../../../../../../../../../etc/passwd%00
So I simply searched it and found out there was a user named patrick.
CS-Cart 1.3.3 RCE
This version was also vulnerable to malicious file upload leading to RCE. I found an exploit reatva/CS-Cart-1.3.3-RCE. It needed admin login so at first I tried to login admin page.
I only used default admin:admin credentials and it worked.
Later, I simply executed the exploit and got reverse shell as www-data.
And I read the user flag.
Privilege Escalation
default credentials and sudo ALL
Later, I tried many methods but non of them worked. This was an old system and I could not execute anything.
I then tried default credentials patrick:patrick and it worked. Moreover, calling sudo -l revealed I could run ALL commands as sudo. So I simply executed sudo bash and got root.