If everything goes correctly, you should now have a root shell and be able to retrieve the root flag.
Analyzing the output, you might find that certain commands can be run without a password. Use this information to escalate privileges:
is an easy-rated web challenge on Hack The Box (HTB) that tasks players with infiltrating a cryptic software interface from an ancient architecture firm. The challenge emphasizes core cybersecurity skills, including source code review, directory fuzzing, and the exploitation of Server-Side XSS (Cross-Site Scripting). Challenge Overview
There are flaws in how the application identifies privileged users, which can be bypassed to gain elevated access.
Every quest begins with a whisper. You scan the target:
' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT('hacker',user_login),NULL,NULL FROM wp_users --
Try re-creating the rune_decoder binary and see if you can find a different way to escalate without touching the root flag.