Challenge

The API on 5000 still served v1, which exposed a show command. With a hint on 80, it read sid’s .bash_history for the Werkzeug PIN 123-321-135. The /console prompt took a Python reverse shell as sid.

The SUID try-harder binary compared input against a XOR expression. Ghidra gave:

number = 0x5dcd21f4 ^ 0x116 ^ 0x5db3   # 1573743953

Entering that returned a root shell.

Flags

  • user 4ea65eb80ed441adb68246ddf7b964ab
  • root e29b05fba5b2a7e69c24a450893158e3