Privilege Escalation: A Capability Too Far

You have a foothold as 'student' — an ordinary account with NO sudo. Modern Linux can hand a single program a sliver of root's power without making it set-user-ID: a file capability. Used well, that is least-privilege. Used carelessly, one capability on the wrong binary is a straight line to root.

1. Enumerate. Walk the filesystem for files that carry capabilities. Most boxes have none off the shelf. This one has a program an administrator gave a capability so a monitoring job could do its work — and the capability they chose is the one that lets a process change its own user ID.

2. Abuse it. The flagged program is a general-purpose interpreter. Because it holds the set-user-ID capability in its effective set, code it runs can set its UID to 0 and keep it — no password, no sudo. Use it to get a shell running as root.

3. Prove it. From that root shell, write a marker to /root/pwned.txt (only root can write inside /root), then read the root-only flag at /root/flag.txt and save it to /home/student/loot.txt.

Grading reads the machine state: a /root/pwned.txt owned by root, and your loot matching the real flag. There is no way to pass without actually becoming root — and the fix is simply to take the capability back off a binary that never needed it.