Schooled

We exploit an XSS in Moodle to steal a session cookie and a Moodle 3.9 CVE that leads to RCE. For privilege escalation, we become root through the pkg command, due to misconfigured permissions in /etc/sudoers

March 28, 20248 minutes