Shyam Pareek

Starting with the Nmap scan, I discovered port 80 opened

So I went ahead and browsed through the webpage and found a website related to education but nothing useful here.

While looking at the source code of the web pages, I noticed something suspicious with the image file so I downloaded it.

  When I viewed the image file on my terminal, it gave me some message like this:

So we have the password now but the last character is missing in it. I used burp intruder to brute-force the password with all possible characters at the end and found the correct password to be: Th4C00lTheacha#

As mentioned in the message, the Username should be Giovanni.

Moving forward now…

I started the recursive directory buster and found moodle directory along with the config file which contained the password of the database and the name of the database. I was able to log in to moodle using the password message hidden inside the image.

So, I have one more credential which I can use later maybe.

Now, I searched for some moodle exploits and found one RCE vulnerability exploit which I could use here.

As the exploit says, we need to add a question and the payload is injected in the answer field.

Here we go with the payload injection.

And I got the reverse shell!

As I already had the database name and password. I logged into the MariaDB!

After successfully logging into the database I searched for the username and password tables and found some credentials. There were 2 users under the name Giovanni and one seems to be a backup user. 

I searched for the password hashes and was able to crack one of them easily, which belonged to user Giovannibak. The cracked hash gave me the password as expelled.

Then I was successful in logging in as a user with the credentials and got the user flag.

Moving forward to root now.

Now I could edit the shadow file directly

So let’s change the root hash to user hash

Finally, I was able to access the root user with the same password as the user.