Challenge

Anonymous FTP gave .flag and a note about weak passwords. hydra found rcampbell:zxcvbn. The /backdoor/ page set its cookie to the submitted password on any non-error response.

linpeas showed python3.6 with cap_setuid.

python3.6 -c 'import os; os.setuid(0); os.system("/bin/bash")'

Root, thm{b94f8d2e715973f8bc75fe099c8492c4}.