Author: lomar
Sea
- T1566.002
- T1204.001
- T1068
- T1127
Discovery
When we look at the source code of the HTML page, we see that static files for the website are kept in the path themes/bike/velik71***. Unfortunately, we cannot access the /themes path because we are not authorized, but we can easily access it if we know the names of the files.
When we search themes/bike/velik71 on Google, we see that a Content Management System called WonderCMS uses these theme files, you can also find the Github repository when you search in detail.
As you can see from the photos above, in a CVE vulnerability created for WonderCMS, the administrator of our website is phishing attacked and creates a vulnerability in the website.
Web Exploit
In the /var/www/sea folder we see some files related to our website, if we take a look at the data folder you can see the configuration files related to the database. The user password required to access the database is encrypted in Becrypt format.