Writeup of 20 points Hack The Box machine - FriendZone. That box was full of rabbitholes :). I won't deny it - I fell for some of them! User flag is accessible due to trivial, yet required some guessing, PHP bug. But only after DNS zone transfer.Root flag was pretty straightforward - required editing python native library. Detailed writeup is available.