Sudo and SUID audit
Lightning Logistics sorts 40,000 parcels a day and nobody has ever run an audit. The server has several misconfigurations that look harmless on their own but together open the batch vault. Find them all with the audit tools and collect the pieces: only the last step leads to the report.
Lab 5 of 5 in the Privilege Escalation path. If you get stuck you have 3 hints, from the vaguest to the most precise: they cost 0, 80 and 200 XP.
What you learn
Objectives complete themselves while you work in the terminal; each one is worth experience points:
- Read the sudo rules: what can your user really do? (100 XP)
- List the programs with the SUID bit (150 XP)
- Check the running processes (150 XP)
- Read the protected key with sudo (250 XP)
Topics: privesc, sudo, suid, audit, boss.
Commands you will use
The terminal is simulated and understands about forty Linux commands. In this lab you will mostly need these:
cat: prints the contents of a file: the most direct way to read configurations, notes and logs.sudo: runs a command with another user’s privileges, usually root; with -l it lists what you are allowed to do. Every rule that is too broad is a risk.find: searches for files by name, type or permissions across a whole folder tree; in an audit it turns up keys, forgotten copies and programs with dangerous permissions.ps: lists running processes with their arguments, which every user on the machine can see.ls: lists the files in a folder; with -l it shows permissions and owners, with -a hidden files too. It is the first command on any machine.grep: finds the lines that contain a word, even across whole folders with -r. It is the main tool for analysing text and logs.curl: makes HTTP requests from the terminal and shows the server’s raw answer, headers included.
The simulated environment
You work in a simulated Linux shell, in the home folder of the user runner: invented files and folders, no network target.
Besides the home folder there is a complete simulated system, with configuration files, logs, users and permissions to examine.
Local services also run on the machine:
- SSH: encrypted remote command-line access; it is protected with keys instead of passwords and without direct root login.
- Web (HTTP): a web server with pages, APIs or admin panels: the most exposed part of almost every organisation.
The defensive lesson
Once the lab is solved, the write-up explains what went wrong and how to protect yourself:
No single mistake opened the vault on its own: sudo on grep to read the logs, a well-protected key, a SUID program that only prints a number, an agent with its user name in the command line. Together they form a chain. Defensive lesson: audit configurations jointly, not one check at a time; least privilege (sudo grep reads any file: better a group with read access to the logs alone), no needless SUID programs, no service details in process arguments, rotated keys and the audit repeated after every change.
Before and after this lab
To unlock it you must have solved:
- Executables with the SUID bit (Privilege Escalation, medium)
- Secrets in processes and local services (Privilege Escalation, medium)
It is one of the final labs: no other lab requires it.
The Privilege Escalation path
Privilege Escalation is an audit path here: you are on a server as a normal user and you check whether some misconfiguration lets you gain more privileges than you should have. You examine sudo rules, programs with the SUID bit, credentials forgotten in the history and in files, and secrets passed as process arguments. These are the same checks that people who harden systems run, and each lab ends with the principle that sums them all up: least privilege.