Who am I and what can I do?
You are on the Pennarello & Sons Stationery server as a regular user. Find out who you are and which privileges you were given, then check whether the owner's file in /root is really off limits.
Lab 1 of 5 in the Privilege Escalation path. If you get stuck you have 3 hints, from the vaguest to the most precise: they cost 0, 30 and 100 XP.
What you learn
Objectives complete themselves while you work in the terminal; each one is worth experience points:
- Find out who you are with id (100 XP)
- List what you can do with sudo (100 XP)
- Try to read /root/flag.txt without privileges (100 XP)
- Read the protected file using the sudo rule (150 XP)
Topics: privesc, sudo, audit.
Commands you will use
The terminal is simulated and understands about forty Linux commands. In this lab you will mostly need these:
id: tells you who you are: your user and the groups you belong to, that is the permissions you have.sudo: runs a command with another user’s privileges, usually root; with -l it lists what you are allowed to do. Every rule that is too broad is a risk.cat: prints the contents of a file: the most direct way to read configurations, notes and logs.
The simulated environment
You work in a simulated Linux shell, in the home folder of the user runner: invented files and folders, no network target.
Besides the home folder there is a complete simulated system, with configuration files, logs, users and permissions to examine.
The defensive lesson
Once the lab is solved, the write-up explains what went wrong and how to protect yourself:
sudo -l is the first question to ask on a new machine: the rule on cat looks harmless ("it's for the logs") but it lets you read any file as root, keys and passwords included. Defensive lesson: least privilege. Grant sudo only for the exact command and file that are really needed (even better, a group with read access to the logs alone), avoid generic rules and review the sudoers file every time a ticket is closed.
Before and after this lab
To unlock it you must have solved:
- Permissions and owners (Linux Fundamentals, medium)
After this lab you can move on to:
- Forgotten secrets (Privilege Escalation, medium)
- Executables with the SUID bit (Privilege Escalation, medium)
The Privilege Escalation path
Privilege Escalation is an audit path here: you are on a server as a normal user and you check whether some misconfiguration lets you gain more privileges than you should have. You examine sudo rules, programs with the SUID bit, credentials forgotten in the history and in files, and secrets passed as process arguments. These are the same checks that people who harden systems run, and each lab ends with the principle that sums them all up: least privilege.