Чилиец (Chiliets)

hackerlab

Task: PHP ExifTool image-upload service that interpolates the multipart filename into shell_exec with extension-only validation. Solution: OS command injection via base64-wrapped filename payload, exfiltrate via web static dir, recover SSH password rendered inside a carved PNG, then privesc with sudo NOPASSWD /usr/bin/date (GTFOBins arbitrary file read) to read both flag parts.