Challenge

The public NFS share /srv/nfs held an SSH key for hermes, encrypted as a Vigenere cipher with key n. ssh2john and john recovered the passphrase 147852. Port 3333 served a base64 zip, cracked with fcrackzip (punkrock), for fortuna.

The share was no_root_squash, so a root-owned SUID bash placed from Kali gave root. A lucky_shell binary also handed out root on a good run.

Flag

5a0ea72f9dbcf6f874bed9e4fa4f1f2a