Armaxis chains an IDOR in the password-reset flow to seize the admin account, then abuses a markdown image parser that shells out to an unquoted curl for OS command injection — a single injected cat reads the flag, where the author’s intended route uses curl’s file:// LFI.
Reset chains a password-reset oracle and SQLi-leaked admin hash into an authenticated dashboard, an LFI that is weaponised through Apache log poisoning for RCE as www-data, a misconfigured /etc/hosts.equiv r-services trust that pivots laterally to two separate users, and finally an lxd group membership that mounts the host filesystem for root.
Trick is an Easy Linux machine built around enumeration. A misconfigured DNS zone transfer plus virtual-host fuzzing reveal hidden subdomains, an LFI on one of them leaks an SSH key, and a user in the security group abuses a writable fail2ban action directory to get root once a ban fires.