Vaccine writeup
Task 1
Besides SSH and HTTP, what other service is hosted on this box?
Using a simple nmap -sV -O IP
Answer : FTP
Task 2
This service can be configured to allow login with any password for specific username. What is that username?
Answer : anonymous
Task 3
What is the name of the file downloaded over this service?
Answer : backup.zip
Task 4
What script comes with the John The Ripper toolset and generates a hash from a password protected zip archive in a format to allow for cracking attempts?
Answer : zip2john
zip2john is a tool used to extract password hashes from encrypted ZIP files, allowing them to be cracked using John the Ripper. It works by converting the ZIP file into a format that John the Ripper can process. This helps security professionals and penetration testers recover forgotten passwords or assess the strength of ZIP file encryption. 
We get the password hash then we use john to crack it (using the default john's wordlist) :
We get the password in orange.
Task 5
What is the password for the admin user on the website?
Searching the password within the files in the zip we unlocked, we find this code snippet :
As stated in the code, we only have the MD5 hash of the password, here you can use any tool you want to crack it : John, Hashcat, online tool...
For instance we used md5decrypt :
Answer : qwerty789
After logging into the target website, we can see a user input field (search bar). By testing it, we obtain the following URL parameter:
We will use sqlmap to determine if it's SQLi vulnerable, and to bypass the login page we use the Session ID cookie :
Task 6
What option can be passed to sqlmap to try to get command execution via the sql injection?
Answer : --os-shell
The next step is getting a reverse shell on our target, so you can take a one-liner on Revshells, start netcat, add --os-shell to the previous command and send the payload :
Also we are using rlwrap which enhances the interactivity of a reverse shell by providing features like Line editing (can use arrows to navigate), History and Tab completion.
Task 7
What program can the postgres user run as root using sudo?
To answer we first think of the sudo -l command, but we need the password of the postgres user so let's check some usual directories where a misconfiguration can happen (hardcoded password, logs, ...) :
Okay so we have the password for the postgres user, let's first connect to the target (again) using ssh so we have a more stable shell.
And then sudo -l :
Answer : vi
Task 8
Submit user flag
Answer : Found in /home/postgres
Task 9
Submit root flag
We know we can run vi as root for the /etc/postgresql/11/main/pg_hba.conf file, let's check on GTFOBins if we can leverage this :
Let's apply it in our case :
Once pg_hba.conf opened with vi, we will use the (b) option so type :set shell=/bin/sh then :shell
We are now root and I let you find the flag by yourself.