• Use ;) to login as user and pass
• Use bkdr command to trigger a format string
• Overwrite stack variable to enable list command
• User command injection in popen used by list to get code execution

Writeup

Original writeup (https://fascinating-confusion.io/posts/2022/07/htb-business-ctf-22-insider-writeup/).