Cct2019 Tryhackme | !exclusive!

This query returned a list of users and their corresponding passwords. One of the users had a password that could be used for further exploitation.

Some versions of this room have a cron job that runs backup.sh as root. If that script is world-writable, you can replace it with a reverse shell. cct2019 tryhackme