Challenge

Port 8000 ran vbcms with admin:admin. Editing a page into a PHP reverse shell gave serv1. The support form on 8001 and the free lesson page on 8002 also ran PHP, giving serv3.

A writable cron script did the rest:

echo "chmod 4777 /bin/bash" > /home/serv3/backups/backup.sh

Root. Flags were base64.