Sudo--l

RaspberryPi device that ran PiHole, which had default credentials. Once foothold was obtained, root was a simple sudo -l.

Eventually landed upon finding SQLi on /room.php?cod=, so we dump databases with sqlmap. Foothold is a simple phpMyAdmin credential login, then a phpMyAdmin 4.8.0 exploit to gain a shell. Root was obtained from exploiting root.service.

Enumeration brought me to the realization that we are working with Magento. Whenever you have Magento, magescan is your best course of action. Then, we exploit magento with RCE to come to an admin panel. Eventually, we get a shell from exploiting Magento's Admin Panel. Root was a simple privesc, with sudo -l.

Enumerated with ffuf, to come to the realization that this is just a shocker exploit. Sudo -l listed perl so perl was our privesc.

Jail from HTB, working with Buffer Overflow, and a lot of pivoting.

Exploiting port 79 using finger, cracking passwords, privesc with sudo -l, to then find wget is exploitable.

Discovered a login page, found it had default credentials, exploited a file upload, and privilege escalated with sudo -l.

Very basic machine where we can get foothold through the landing page, and then privesc with sudo -l.