HTB - MetaTwo
TL;DR - A WordPress site vulnerable to CVE-2022-0739 (a BookingPress SQL injection) dumps the manager and admin hashes. Cracking manager gives partylikearockstar and a wp-admin login. From there, CVE-2021-29447 (a WordPress media XXE) lets me read files off the box, including wp-config.php, which has the DB and FTP creds inside. On the FTP share there’s a send_email.php with jnelson’s password in plaintext, and that same password works over SSH (user.txt). For root, a hidden .passpie keyring holds GPG keys, so I crack the passphrase with John, unlock passpie, and export the vault to get the root password (root.txt). ...