Thm

Creds on the page and in robots.txt fed a webshell, where less beat a cat blacklist and sudo less finished it.

A webshell led through sudo find and a SUID cp to the root flag.

An NFS share leaked an SSH key, a cipher and a cracked zip gave users, and no_root_squash planted a SUID bash.

A raw TCP service handed out a TLS key and cert, mutual TLS opened a shell, and layered encoding plus CrackStation gave root.

An SMBv1 host fell to EternalBlue for SYSTEM, then RDP admin for the king server.

A WordPress brute force off a robots.txt dictionary gave a shell, and SUID nmap gave root. Three keys.

SQLi on 81 and a double-extension upload bypass on 82 gave a duku shell and several web-root flags.

A writable FTP script on a timer gave a shell, and SUID env gave root.

Anonymous FTP and hydra gave SSH, a cookie-equals-password page gave a webshell, and python cap_setuid gave root.

WordPress theme injection, an SSH-tunnelled Jenkins, and a note in /opt chained to root across two hosts.