How it went

1. 0
   nmap

   An nmap scan points to a web app that redirects to academy.htb.

2. 1
   roleid parameter

   Registering a user and tampering with the roleid parameter unlocks the admin panel.

3. 2
   Laravel RCE

   A dev-staging-01 subdomain leaks the Laravel APP_KEY, enabling a deserialization RCE as www-data.

4. 3
   cry0l1t3

   Credentials recovered from the config and .env log us in over SSH as cry0l1t3 for the user flag.

5. 4
   /var/log

   cry0l1t3's adm group grants read access to /var/log, where mrb3n's password turns up in command history.

6. 5
   mrb3n

   su to mrb3n, who holds a sudo rule on composer.

7. 6
   composer

   composer's sudo entry spawns a root shell.