Privilege Escalation: One Sudo Rule Too Many

You are 'student' on this box, and this time you DO have one sudo grant — a single command the administrator decided was safe to let you run as root without a password. It is not safe. Many ordinary commands, when run as root, can be turned into a full root shell; this is exactly what GTFOBins catalogs.

1. Discover your grant: sudo -l. It lists one NOPASSWD command you may run as root.

2. Escalate. The granted command can launch other programs. Run it through sudo the way GTFOBins documents so that the shell it spawns is root — not just the one command.

3. Prove it. From that root shell, write a marker to /root/pwned.txt, then read the root-only flag at /root/flag.txt and save it to /home/student/loot.txt.

This is the single most common real-world Linux escalation: a too-broad sudoers entry. Grading reads the machine state — /root/pwned.txt owned by root and your loot matching the real flag — so there is no shortcut past actually escalating.