Help
A GraphQL API on port 3000 leaks HelpDeskZ credentials through introspection; the cracked password logs us into the help desk, whose unauthenticated arbitrary file upload yields a reverse shell. An outdated kernel is then exploited with CVE-2017-16995 for root.