How I Scored First Place at the Feasible Security Live CTF
It started with a leaked WordPress installer password. From there I took over Gitea, uploaded PHP to the Reports Portal, and abused a sudo rule on Backup to get root.
WordPress → Gitea → Reports Portal → Backup → root