$ cat writeup.md…
$ cat writeup.md…
hackerlab
Task: WordPress 6.5.2 with My Calendar 3.4.21 plugin and SSH on Ubuntu. Solution: CVE-2023-6360 unauthenticated time-based blind SQLi to extract wp_users hashes → crack phpass with rockyou → SSH as mansory → sudo wildcard path traversal to read /root/last_part.
Permission denied (requires tier.pro)
Sign in with GitHub, Discord, or Google to continue. No email required.
$sign in$ grep --similar