Симпсоны (Simpsons)

hackerlab

Task: PHP ZIP-hosting app extracts uploads and prints contents; extension blacklist misses .phar. Solution: chain .phar webshell RCE (www-data) + zip --symlinks arbitrary read, reuse leaked creds to su mikki for half the flag, then abuse sudo zip + sudo ln symlink chain to read /root/last_part as root and assemble the flag.