Register yourself as admin
The signup at /app/register copies every field you send onto the new account. Register an account that comes back with role: admin, and capture the flag it returns, saving it under your home.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Solution explanation
The server built your account from every field in the request, so an extra role=admin — one the form never offered — made you an admin at signup. Bind only an explicit allow-list of fields and set privileged attributes server-side, never from user input.
Show solution
cd /home/student
curl -s -d 'username=mallory&password=pw&role=admin' http://127.0.0.1:8080/app/register | tee loot.txt