Management is an Easy difficulty HackTheBox machine that hosts a vulnerable web application allowing unauthenticated Remote Code Execution through a deserialization flaw. Initial foothold yields a low-privileged shell, leading to internal database enumeration where an encrypted service password is extracted. Decrypting this secret using a locally discovered key file provides SSH access as the target user. Root access is then achieved by exploiting parameter handling in a restricted backup utility command running with elevated privileges to read arbitrary system files.
https://projectnullbyte.com/article/hack-the-box-management-walkthrough
#hackthebox
