Sudo Misery Loves Company

A low-privilege service account can somehow run a root shell. Someone widened its sudo rights and hid the change in plain sight — not in /etc/sudoers, but in a drop-in under /etc/sudoers.d. Track down the misconfiguration, understand how it grants escalation, and recover the flag it guards.

Record under /root/case, then submit the flag in the CTF panel:

1. Read every file under /etc/sudoers.d — find the drop-in that grants the escalation. Record its full path to /root/case/finding.txt.

2. Identify the NOPASSWD binary it allows (one that can shell out or read arbitrary files). Record its full path to /root/case/binary.txt.

3. Recover the flag from /root/flag.txt. Record it to /root/case/flag.txt.

See /root/case/brief.txt.