https://ctf-hallllow.blog/tags/ftp/ Recent content in Ftp on hallllow Hugo en-us Wed, 28 Oct 2026 00:00:00 +0000 https://ctf-hallllow.blog/posts/metatwo/ Wed, 28 Oct 2026 00:00:00 +0000 https://ctf-hallllow.blog/posts/metatwo/ HTB MetaTwo (Easy). A WordPress box: a BookingPress SQL injection (CVE-2022-0739) dumps the manager hash, cracked to log into wp-admin. A WordPress media XXE (CVE-2021-29447) reads wp-config.php for the DB and FTP creds. The FTP share has a send_email.php with jnelson's SSH password, and root comes from cracking a passpie GPG keyring to export the stored root password.