Just gonna make this clear first, this is for class!
I have an assignment that requires to 1) modify a web server written in Java to accept file uploads and to use this to deface the homepage (did that no problem).
2) Take root ownership of the machine.
I'm hitting a bit of a wall with the second part. I used curl with an HTTP GET to traverse to the etc/passwd file but then later found that no passwords are stored here. I know the shadow file has the passwords stored, but I can't access it. The server kicks back a 404 when I try to, I'm assuming permissions are the issue.
My command for curl looks like this:
Although I'm doing this from the same machine that the server is running on, I have to play it as if I don't have access to the server. Any help in pointing me in the right direction to go from here is appreciated!