Challenge

wpscan found wendy:changelater. The User Role Editor plugin raised wendy to admin, and a Hello Dolly edit caught a www-data shell (user flag 0052f7829e48752f2e7bf50f1231548a). A world-readable id_rsa in /var/backups let me SSH as jack.

jack’s group could write every Python module, and root ran /opt/statuscheck/checker.py every two minutes. It imported os, so a hijacked module copied root.txt out.

Flag

root b8b63a861cc09e853f29d8055d64bffb