<!-- mobian-agent-page publisher="dailydev" canonical="https://daily.dev/posts/htb-makesense-9szs5mrr0" -->

---
title: HTB: MakeSense | daily.dev
description: A HackTheBox machine called MakeSense is solved by chaining a WordPress voice-call widget into full root access. An uploads directory lists a WAV file where a...
canonical: https://daily.dev/posts/htb-makesense-9szs5mrr0
twitter:card: summary_large_image
twitter:site: @dailydotdev
og:type: website
og:site_name: daily.dev
og:title: HTB: MakeSense | daily.dev
og:description: A HackTheBox machine called MakeSense is solved by chaining a WordPress voice-call widget into full root access. An uploads directory lists a WAV file where a...
og:url: https://daily.dev/posts/htb-makesense-9szs5mrr0
og:image: https://api.daily.dev/og/posts/9sZs5MrR0.png
og:image:alt: HTB: MakeSense
og:image:width: 1200
og:image:height: 630
og:locale: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# HTB: MakeSense

**[0xdf hacks stuff](https://daily.dev/sources/0xdf)** · 49 min read · 0 upvotes · 0 comments

## Summary

A HackTheBox machine called MakeSense is solved by chaining a WordPress voice-call widget into full root access. An uploads directory lists a WAV file where a user reads credentials aloud, giving login as 'jake'. The voice channel's AES-GCM encryption is reverse engineered (key derived from a hardcoded string) to submit arbitrary transcription text, enabling stored XSS against an admin bot. That XSS creates a new admin user and a webshell via the plugin editor, yielding a www-data shell. A password hardcoded in wp-config.php reused for the 'walter' Linux account gives SSH access, and root is reached by abusing a root-owned OCR web app listening on port 8001 that writes recognized text to an arbitrary filename, allowing PHP code embedded in an image to be written and executed.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://0xdf.gitlab.io/2026/10/31/htb-makesense.html>

## Questions this post answers

### How can stored XSS in a WordPress contact form be used to create a new admin user?

By injecting a script tag that loads a payload like WPForce's add_admin.js, which uses an authenticated admin's session (via an XSS-triggering bot) to POST to /wp-admin/user-new.php with a scraped _wpnonce_create-user value, creating a new administrator account with attacker-chosen credentials.

_Developers hardening WordPress against stored XSS can track writeups like this on daily.dev._

### How do you get code execution on a WordPress site after obtaining admin access?

Use the Plugin File Editor under Plugins in wp-admin to edit an existing plugin file, such as akismet.php, and insert a simple PHP webshell at the top of the file. Saving the file writes it directly to disk, and the webshell can then be triggered by sending a POST request with a command parameter to that plugin's URL.

_Those researching WordPress post-exploitation paths can follow similar techniques on daily.dev._

### Why would a WordPress site store a database password in wp-config.php even when using SQLite instead of MySQL?

Because WordPress core still requires DB_NAME, DB_USER, DB_PASSWORD, DB_HOST and DB_CHARSET constants to be defined even when a SQLite plugin replaces the actual database backend, so administrators sometimes populate these dummy MySQL settings with a real system password, and that password can then be reused to access a Linux user account like 'walter' via su or ssh.

_Security reviewers auditing WordPress configs for leaked credentials can find similar case studies on daily.dev._

## Similar posts on daily.dev

- [HTB: Silentium](https://daily.dev/posts/htb-silentium-sauvsknv6) · 0xdf hacks stuff · 0 upvotes · 0 comments
- [HTB — Strutted Writeup: Linux Machine](https://daily.dev/posts/htb-strutted-writeup-linux-machine-x6cn8azui) · InfoSec Write-ups · 1 upvotes · 0 comments
- [HTB: Facts](https://daily.dev/posts/htb-facts-09nlopse0) · 0xdf hacks stuff · 0 upvotes · 0 comments
- [\[HS\] Dark Writeup](https://daily.dev/posts/hs-dark-writeup-roulrgb8j) · InfoSec Write-ups · 0 upvotes · 0 comments
- [HTB: Guardian](https://daily.dev/posts/htb-guardian-tkykgwaky) · 0xdf hacks stuff · 1 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#wordpress](https://daily.dev/tags/wordpress)

[View this post on daily.dev](https://daily.dev/posts/htb-makesense-9szs5mrr0)

```json
{"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]}
{"@context":"https://schema.org","@type":"TechArticle","headline":"HTB: MakeSense","url":"https://daily.dev/posts/htb-makesense-9szs5mrr0","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/htb-makesense-9szs5mrr0"},"datePublished":"2026-10-31T15:07:52.648Z","dateModified":"2026-10-31T15:08:25.815Z","description":"A HackTheBox machine called MakeSense is solved by chaining a WordPress voice-call widget into full root access. An uploads directory lists a WAV file where a...","image":"https://media.daily.dev/image/upload/s--CxzD6vbw--/f_auto/v1722860399/public/Placeholder%2005","thumbnailUrl":"https://media.daily.dev/image/upload/s--CxzD6vbw--/f_auto/v1722860399/public/Placeholder%2005","isAccessibleForFree":true,"articleSection":"0xdf hacks stuff","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"0xdf hacks stuff","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/16cdada70d5f4fac8b588c53bcf005ff","url":"https://daily.dev/sources/0xdf"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/htb-makesense-9szs5mrr0","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,wordpress","timeRequired":"PT49M"}
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"0xdf hacks stuff","item":"https://daily.dev/sources/0xdf"},{"@type":"ListItem","position":3,"name":"HTB: MakeSense"}]}
{"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/htb-makesense-9szs5mrr0#faq","mainEntity":[{"@type":"Question","name":"How can stored XSS in a WordPress contact form be used to create a new admin user?","acceptedAnswer":{"@type":"Answer","text":"By injecting a script tag that loads a payload like WPForce's add_admin.js, which uses an authenticated admin's session (via an XSS-triggering bot) to POST to /wp-admin/user-new.php with a scraped _wpnonce_create-user value, creating a new administrator account with attacker-chosen credentials. Developers hardening WordPress against stored XSS can track writeups like this on daily.dev."}},{"@type":"Question","name":"How do you get code execution on a WordPress site after obtaining admin access?","acceptedAnswer":{"@type":"Answer","text":"Use the Plugin File Editor under Plugins in wp-admin to edit an existing plugin file, such as akismet.php, and insert a simple PHP webshell at the top of the file. Saving the file writes it directly to disk, and the webshell can then be triggered by sending a POST request with a command parameter to that plugin's URL. Those researching WordPress post-exploitation paths can follow similar techniques on daily.dev."}},{"@type":"Question","name":"Why would a WordPress site store a database password in wp-config.php even when using SQLite instead of MySQL?","acceptedAnswer":{"@type":"Answer","text":"Because WordPress core still requires DB_NAME, DB_USER, DB_PASSWORD, DB_HOST and DB_CHARSET constants to be defined even when a SQLite plugin replaces the actual database backend, so administrators sometimes populate these dummy MySQL settings with a real system password, and that password can then be reused to access a Linux user account like 'walter' via su or ssh. Security reviewers auditing WordPress configs for leaked credentials can find similar case studies on daily.dev."}}]}
```