$ cat writeup.md…
$ cat writeup.md…
hackerlab
Task: full-chain Umbrella Corp box — Flask landing with reflected 404 SSTI, world-readable /etc/shadow, Docker container pivot to host FTP. Solution: Jinja2 SSTI RCE via cycler globals, john+rockyou cracks root ($6$) to 'rootless', then anonymous FTP on 172.17.0.1 for last flag part.
Permission denied (requires tier.pro)
Sign in with GitHub, Discord, or Google to continue. No email required.
$sign in$ grep --similar