This machine was retired yesterday, so I decided to publish my writeup the day after. CodePartTwo is an easy machine, which runs a Flask web app vulnerable to RCE due to an outdated and vulnerable library it uses. Once exploited we can dump and crack the registered users' passwords hashes (MD5). That gives us a SSH access, along with the User Flag. Retrieving the Root Flag exploits a weakness in a backup utility the user has root access over (via sudo). ...
This is my second writeup, after my first one covering the Conversor machine (machine not yet retired, therefore writeup not yet published). I fell into a few rabbit holes trying to pwn this one, I’m sad to say. We’ll get to that part as well, but first: enum. mairon $ nmap -Pn -n -v --open --top 5000 10.129.7.105 Starting Nmap 7.98 ( https://nmap.org ) at 2026-01-26 21:12 +0100 Initiating Connect Scan at 21:12 Scanning 10.129.7.105 [5000 ports] Discovered open port 80/tcp on 10.129.7.105 Discovered open port 22/tcp on 10.129.7.105 Completed Connect Scan at 21:12, 1.28s elapsed (5000 total ports) Nmap scan report for 10.129.7.105 Host is up (0.017s latency). Not shown: 4998 closed tcp ports (conn-refused) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http Read data files from: /usr/bin/../share/nmap Nmap done: 1 IP address (1 host up) scanned in 1.29 seconds ...