Root the box
No walkthrough this time. You have a foothold as student and a machine full of mistakes. Enumerate, pick a path, escalate to root, and read the flag at /root/root.txt.
Any of the techniques from this course works — choose whichever you like. Then write a one-line note of the method you used.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Hints
Work the checklist: `id`, `sudo -l`, `find / -perm -4000 -type f 2>/dev/null`, `ls -l /etc/passwd`, the cron jobs, `grep -ri pass /var/www`.
The single fastest path is `sudo less /root/root.txt` — the NOPASSWD rule makes less run as root.
Solution explanation
You ran the enumeration checklist, found a path and took it — the reference solution used the quickest one, the NOPASSWD sudo rule for less, but SUID find, the writable /etc/passwd, either cron job or the reused password would all have reached the same flag. That is the real lesson of privilege escalation: a box rarely has one way up, it has whichever mistakes the admin left behind — and your job is to find any single one of them. Now you can both attack these paths and, just as importantly, close them.
Show solution
cd /home/student
sudo -l
sudo less /root/root.txt | cat
echo 'Used the sudo less NOPASSWD rule to read the root flag.' > /home/student/report.txt
sudo less /root/root.txt | cat >> /home/student/report.txt