HTB: Challenge - Armaxis
Armaxis chains an IDOR in the password-reset flow to seize the admin account, then abuses a markdown image parser that shells out to an unquoted curl for OS command injection — a single injected cat reads the flag, where the author’s intended route uses curl’s file:// LFI.