https://zer0arc4.github.io/tags/www-data/Recent content in Www-Data on zer0arc4Hugoen-usThu, 08 Oct 2026 22:35:36 +0530https://zer0arc4.github.io/writeups/tryhackme/looseends-tryhackme-writeup/Tue, 06 Oct 2026 22:50:20 +0530https://zer0arc4.github.io/writeups/tryhackme/looseends-tryhackme-writeup/Compromised LooseEnds through Vvveb CMS 1.0.5 by decoding exposed administrator credentials, exploiting CVE-2025-8518 for PHP code execution, recovering database credentials for bunny, abusing the monkeys group to access zer0arc4’s SSH key, and exploiting sudo dpkg to obtain root.https://zer0arc4.github.io/writeups/tryhackme/pickle-rick-tryhackme-writeup/Wed, 30 Sep 2026 22:01:57 +0530https://zer0arc4.github.io/writeups/tryhackme/pickle-rick-tryhackme-writeup/Compromised the Pickle Rick machine by discovering a username in the website source code, recovering the password from robots.txt, accessing a command execution panel, obtaining a www-data reverse shell, discovering the potion ingredients, and escalating to root through unrestricted sudo privileges.https://zer0arc4.github.io/writeups/tryhackme/rootme-tryhackme-writeup/Tue, 29 Sep 2026 22:09:19 +0530https://zer0arc4.github.io/writeups/tryhackme/rootme-tryhackme-writeup/Compromised the RootMe machine by discovering the hidden /panel/ directory, bypassing the PHP upload restriction with a .phtml extension to obtain a www-data reverse shell, and escalating to effective root privileges through the SUID-enabled Python interpreter.https://zer0arc4.github.io/writeups/vulnyx/craftfall-vulnyx-writeup/Mon, 28 Sep 2026 17:49:32 +0530https://zer0arc4.github.io/writeups/vulnyx/craftfall-vulnyx-writeup/Compromised the CraftFall machine by exploiting Craft CMS 5.6.16 through CVE-2025-32432 to obtain a www-data shell, abusing a world-writable scheduled script to move to zer0arc4, establishing stable SSH access, and exploiting sudo-enabled autoconf through the AUTOM4TE environment variable to obtain root.