Routingport-forward

Boolean-based SQL injection, which gives access to a database, then we authenticated file fuzz leading to bypassing .htaccess in apache which gives RCE. Once foothold from RCE was obtained, we pivot as mark, find a local hosted web server, and exploit npm to root.

SNMP enumeration to find credentials to gain a shell, which we then route to find Pandora CMS, which wa vulnerable to SQLi, to gain foothold. For root, $PATH was exploited.

Interesting machine where we find a php file, exploit LFI to gain a shell, and privesc through ps aux uncovering VNC.