Layover - HTB Machine Writeup

Difficulty: Medium | OS: Linux | Status: Completed

Pivot from an RDP Linux desktop through an open Wi-Fi network to sniff cleartext staff credentials, chain a Craft CMS 5.9.8 authenticated RCE with Craft-key secret decryption for user access, then escalate to root via a CUPS IPP local privilege-escalation exploit.

Tags: Craft CMS RCE, Wireless Sniffing (802.11), CUPS Privilege Escalation