Root through a reused password
A web-app config under /var/www leaks a password in plain text. The admin reused it.
Find the leaked password, then use it to become root with su and read the flag at /root/root.txt.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Hints
`cat /var/www/app/config.php` shows the DB password in plain text.
`su root` and enter that same password — admins reuse them.
Solution explanation
The web-app config in /var/www/app/config.php held a database password in plain text, and the administrator had reused it as the system's root password. So su root with that one leaked string dropped you straight into a root shell — no misconfigured binary or writable file required. Password reuse plus a readable config is a devastatingly common combination, which is why secrets belong in locked-down stores and must never be shared across accounts.
Show solution
cd /home/student
cat /var/www/app/config.php
su root
cat /root/root.txt
exit