https://d3bo.eu/en/tags/xss/Recent content in XSS on d3boHugo -- gohugo.ioenCopyright (c) 2025 HyasThu, 28 Mar 2024 00:00:00 +0000https://d3bo.eu/en/writeups/hackthebox/schooled/Thu, 28 Mar 2024 00:00:00 +0000https://d3bo.eu/en/writeups/hackthebox/schooled/We exploit an XSS in Moodle to steal a session cookie and a Moodle 3.9 CVE that leads to RCE. For privilege escalation, we become root through the pkg command, due to misconfigured permissions in /etc/sudoers