Hack The Box

I just solved Cohort on HackTheBox by using an SSRF bypass to discover an internal marimo service and gaining a shell through an unauthenticated websocket terminal then exploiting a packagekit toctou vulnerability to get root 🔥🔥