A box about getting an RCE via LFI and Log Poisoning. Then abusing a cronjob that used a file with weak permissions. And then analysing a suid binary which used relative paths instead of absolute paths which made it vulnerable to path injection.

Forwardslash writeup. I went through the LFI way. I used rockyou to break the crypto.

Rooting ServMon with curl

Rooting Smasher