$ cat writeup.md…
$ cat writeup.md…
hackerlab
Task: Apache Tomcat 8 login form that logs user input via vulnerable Log4j 2.x; page title hints at Log4Shell. Solution: inject JNDI payload in username field, use marshalsec LDAP referral server to redirect to malicious Java class, achieve RCE and exfiltrate flag from /root/.fl4g.txt.
Permission denied (requires tier.pro)
Sign in with GitHub, Discord, or Google to continue. No email required.
$sign in$ grep --similar