I have access to a Wordpress blog and want to read the server's /root directory that belongs to the user "root" and not "www-data". I also know his password, but I can't open an interactive shell to be even asked about that bit of information..
Well, I have downloaded the plugin WPTerm, with which I can call python scripts or write php files to be executed in the front end, but I run into trouble due to the following issues:
sudo is not available: sh: 1: sudo: not found
su does not work: su: must be run from a terminal
ssh and nc are also not available
It seems that this webserver runs in a docker environment and the Loginizer plugin tells me, that the server has the private IP Address: Server's IP Address 172.18.0.6
How the hell do I spawn an interactive shell where I can bypass the "su: must be run from a terminal" error message? I seriously have no idea what to do next, maybe some kind of shellcode for php or python would work.