Challenge

A report viewing web app whose input validation lived entirely in client side JavaScript. Anything the browser refused to send could be sent directly with a crafted request.

Foothold

Bypassing the JS check exposed command execution on the server. Rather than go straight for a shell, the cleaner path was a file read: pull the user’s SSH private key, then log in over SSH for a stable session. That gave the first flag.

Privilege escalation

The box had a SUID gawk. gawk can read root-owned files directly (GTFOBins):

gawk '//' "$LFILE"

Pointing $LFILE at the root flag returned the second flag, giving both.