HTB: SwagShop

Linux machine exploiting the Magento Shoplift SQL injection to create an admin user, chaining an authenticated Magento RCE for a shell, and abusing a sudo vi rule for root.

January 24, 2026 · 4 min