How it went

1. 0
   nmap

   An nmap scan shows a LiteCart e-commerce site on port 80.

2. 1
   Nikto backup

   Nikto finds a site backup archive; a config file inside leaks database credentials and the admin email.

3. 2
   hidden .log

   A comment in the login source points to a hidden .log file that stores the admin credentials in cleartext.

4. 3
   LiteCart upload

   LiteCart 2.1.2's authenticated upload, with a Content-Type bypass, places a webshell, though most PHP functions are disabled.

5. 4
   disable_functions

   A PHP disable_functions bypass restores code execution as www-data.

6. 5
   MySQL UDF

   A malicious exec_cmd function planted in MySQL runs commands as the mysql account; an SSH key written to its authorized_keys gives a shell.

7. 6
   sysadmin

   Password-change history in mysql's home reveals the sysadmin password for an SSH login and the user flag.

8. 7
   PAM backdoor

   A backdoored pam_unix.so holds a hardcoded password; recovering it from the binary gives root over su.