Funhxx17.zip ›

If you used a symlink, you can now read the linked file through the web server.

Scanning the web server (Port 80) usually reveals a directory like /backups/ where this same zip file might be hosted or referenced. 2. Exploiting FUNHXX17.zip FUNHXX17.zip

Because the unzipping process often runs with high privileges (or as a user with write access to the webroot), you can create a malicious zip file containing a symbolic link . If you used a symlink, you can now

Depending on the version of the VM you are running, it may be vulnerable to recent Linux kernel exploits. Exploiting FUNHXX17

Most write-ups note that FTP allows Anonymous login . Inside the FTP directory, you will find FUNHXX17.zip among other files.

Look for writable scripts in /etc/crontab that are executed by root.