Need a nudge. I know the magic word, have seen the source and checked the binary used on Scavenger. But how can you use it if you do not have a real tty shell? What cmd are passed to a “shell” in php space does not seem to work for this kind of exploit … or is there some insane shell-fu redirection and fifo? Sooooo close!
Edit: Got root!
Thank you @bumika for the nudge.
Root Hint: Look gift horses in the mouth before making assumptions of worth. It may well be worth making a personal inspection.
Very fun, awesome box. I totally missed what is probably literally one of the oldest hideouts in the history of Unix for quite awhile, missed the breadcrumbs which pointed the way every time I looked. Thanks, @ompamo. 