For Hermit 2, I was initially confused as to why the link wasn't working. I asked support about itand they said to use the original link for Hermit 1.
First, refer to the trick for hermit 1, which is that you can trick the website into thinking a phpfile is a png file by changing the extension to '.png', thereby, running arbitrary commnands andgetting output through the simple php file
  ')	  ?>
For example, if I wanted to run "rm -rf /" (which I definitely don't, but if I did...), I'd simply type
  
After that, I decided to enumerate users by looking at the /etc/passwd, as the hint told me to, by running "/etc/passwd".That didn't help, so I enumerated hermit's groups and, lo and behold, what pops up is
hermit sudo
So, I'm part of the sudo group. That's interesting. Let me open '/etc/sudoers' to find out what I can do.So I run 'cat /etc/sudoers' to get some output with the following line being of interest.
hermit ALL = (root) NOPASSWD: /bin/gzip -f /root/rootflag.txt -t
Looking online for how to configure sudoers reveals that this allowsme to run the following command without a password.
A natural next step was to actually run "/bin/gzip -f /root/rootflag.txt -t" to get
UMASS{a_test_of_integrity}
as output.
