Challenge

/upload took PHP and /betatest/ held a webshell and a flag. The SMB public share gave flag.txt, alert.txt, and narrator:X8JEETQmf3hkS65f.

SUID /usr/bin/vim edited /etc/sudoers for NOPASSWD, then sudo -i gave root. tdurden’s id_rsa from the webshell was a second way in.

Flags

  • 991c65538b9afaf2494f4552b915c948
  • 562216ebd6128e6e3ea13dbe6bcaf46a
  • 2308b0cccea3f2a187a89a9f3155a3a4
  • root 9a2d57cc33cd052a88fd5ba25d1c953c