Privilege Escalation: The SUID Shortcut

You have a foothold on this box as 'student' — an ordinary account with NO sudo. Your prompt ends in $, not #. An administrator, trying to make a file-auditing job easier, left a helper binary set-user-ID root: it runs as root no matter who launches it. That one convenience is your way up.

1. Enumerate. SUID-root files are the first thing an attacker (and a defender) looks for — search the whole filesystem for files carrying the set-user-ID bit. Most of the hits are legitimate (sudo, su, passwd, mount, ping). One is not — it lives off the beaten path and is really a general-purpose tool wearing an admin's name.

2. Abuse it. The helper is a renamed copy of a standard tool that can launch other programs. Used normally it audits files; used the way GTFOBins documents, it hands you a shell that keeps the binary's root privileges. Get a root shell (euid 0).

3. Prove it. From your root shell, write a marker to /root/pwned.txt (only root can write inside /root), then read the root-only flag at /root/flag.txt and save it to /home/student/loot.txt.

Grading reads the machine state: a /root/pwned.txt owned by root, and your loot matching the real flag. There is no way to pass without actually becoming root.