Reading your sudo rights

sudo is a list of exceptions

sudo lets an administrator say ‘this user may run this command as root’. You are not in the sudo group, so you have no blanket power — but you might still have been granted one specific command. sudo -l lists what you are allowed:

sudo -l

In the terminal (enter the student password (student) when prompted)

student@vulntech:~$ sudo -l
[  649.481348] systemd[1]: Failed to start systemd-journald.service - Journal Service.
Matching Defaults entries for student on vulntech:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin,
    use_pty, lecture=never

User student may run the following commands on vulntech:
    (ALL) NOPASSWD: /usr/bin/less

Read that output carefully. It tells you that student may run /usr/bin/less as any user, with no password (NOPASSWD). That looks harmless — less just views files. It is not harmless at all.

Tip: NOPASSWD rules are the ones to hunt for: they let you act as root without even knowing a password. Always run sudo -l first on any machine you land on.