Irongrep

Premium Machine (Locked)

An Elasticsearch node sits on the network with no authentication. Someone stored application users and plain-text API tokens directly in the index. Extract the credentials, pivot to shell, and abuse a sudo curl policy to overwrite your way to root.