Exfiltrated pg walkthrough Easy

80端口弱口令admin admin
发现cms 搜索exp 发现漏洞
https://www.exploit-db.com/exploits/49876

找到敏感数据库密码和用户

╔══════════╣ Searching passwords in config PHP files
/var/www/html/subrion/includes/api/storage.php:        return ($member && $member['password'] == $iaUsers->encodePassword($client_secret));
/var/www/html/subrion/includes/classes/ia.core.config.php:    const TYPE_PASSWORD = 'password';
/var/www/html/subrion/includes/config.inc.php:define('INTELLI_DBUSER', 'subrionuser');

然后就是提权 有洞直接提
https://www.exploit-db.com/exploits/50911