Skip to content
PURPLEDUEL

Privilege Escalation path

5 labs · From user to root

Privilege Escalation is an audit path here: you are on a server as a normal user and you check whether some misconfiguration lets you gain more privileges than you should have. You examine sudo rules, programs with the SUID bit, credentials forgotten in the history and in files, and secrets passed as process arguments. These are the same checks that people who harden systems run, and each lab ends with the principle that sums them all up: least privilege.

The labs, in order

  1. Who am I and what can I do?

    medium · 600 XP

    You are on the Pennarello & Sons Stationery server as a regular user. Find out who you are and which privileges you were given, then check whether the owner's file in /root is really off limits.

    Requires: Permissions and owners.

  2. Forgotten secrets

    medium · 600 XP

    The sysadmin of the Crumiro Biscuit Factory is on holiday and left the deploy panel behind a password nobody knows. But people in a hurry leave traces: look in the command history and in the service files, then get into the panel.

    Requires: Who am I and what can I do? and Environment and history.

  3. Executables with the SUID bit

    medium · 600 XP

    Rotonda & Co. Printing House has not checked its program permissions since 2023. List the programs that run with root privileges no matter who launches them, find the one that should not be there and see what it does.

    Requires: Who am I and what can I do? and Finding files.

  4. Secrets in processes and local services

    medium · 600 XP

    At the Blue Bubble Laundry the agents and services talk to each other on the same machine. Look at what is running (and with which arguments), find out which services listen locally and check whether a secret can end up in the wrong hands.

    Requires: Forgotten secrets and Service banners.

  5. Sudo and SUID audit

    hard · 1000 XP

    Lightning Logistics sorts 40,000 parcels a day and nobody has ever run an audit. The server has several misconfigurations that look harmless on their own but together open the batch vault. Find them all with the audit tools and collect the pieces: only the last step leads to the report.

    Requires: Executables with the SUID bit and Secrets in processes and local services.

Commands in this path

Along this path the simulated terminal has you use these commands: id, sudo, cat, history, grep, curl, find, file, ps, nmap, nc and ls. Each lab page explains what they are for.

Learn more with the guides

All guides

The other paths

The PurpleDuel labs