# TLDR;- There is an SQL Injection in the /login endpoint- After retrieving the database content, cracking the admin hash and logging in as the admin, a new subdomain is revealed- The subdomain has a Server Side Template Injection, so you can get a shell- You now have the user flag- The home folder is mounted in the Docker, so you can write the authorized_keys file and connect as the user to the host through the Docker network- You can use a mknod privilege escalation to be able to read the raw /dev/sda and grep for the flag- You now have the root flag
Complete writeup: [https://radboudinstituteof.pwning.nl/posts/htbunictfquals2021/goodgames/](https://radboudinstituteof.pwning.nl/posts/htbunictfquals2021/goodgames/)