plum (Intermediate, linux, 2023) -- PluXml Blog 5.8.9

[WDavid404]

Keypoints:

• PluXml Blog 5.8.9 Remote Code Execution
• [PE] root credential info is in /var/mail/www-data file

[WDavid404]

PORT   STATE SERVICE REASON         VERSION
22/tcp open  ssh     syn-ack ttl 61 OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0)
80/tcp open  http    syn-ack ttl 61 Apache httpd 2.4.56 ((Debian))

80/tcp --> powered by PluXML

Search exploit info about pluXML -->

• PluXml 5.1.5 - Local File Inclusion
• PluXml Blog 5.8.9 Remote Code Execution
• Pluxml 0.3.1 - Remote Code Execution

Go to admin page Login with admin:admin --> work! --> PluXML v5.8.7

According to PluXml Blog 5.8.9 Remote Code Execution It work!

Run reverse shell command and it works

Linpeas: cat /var/mail/www-data --> root:6s8kaZZNaZZYBMfh2YEW