Go to overwrite.vulns.thm

Look at the source code

Find an image file ~> mountains.jpg

Rename file to be uploaded to "mountains.jpg"

Upload file, get flag

Go to shell.uploadvulns.thm

Download Pentesting Monkey's PHP reverse shell script

Put in IP address of listener
Start Netcat listener

Run a Gobuster scan on overwrite.vulns.thm

Find /resources/

Go to overwrite.uploadvulns.thm
Upload the reverse shell script

Go to overwrite.uploadvulns.thm/resources/phpreverseshell.php (or whatever the file name is)

See error on webpage, check Netcat

We've got a shell!

Check whoami ~> www-data
ls -l /var/www/
cat flag.txt