Offensive Lab · medium · solved in-browser (no VM needed) · 3 tiered hints
Your own disposable practice box. /usr/bin/cp is installed SUID-root, so it can write files owned by root anywhere and the copy keeps root ownership. The plan: copy /bin/bash to a file you control, then give that copy the setuid bit so it runs as its root owner. Write /home/player/ans.txt with the two-step command line: first cp /bin/bash to /home/player/rootbash, then set the SUID permission bit on /home/player/rootbash (chmod 4755 or chmod u+s). (Authored config, graded structurally — the engine isn't run here.)
▶ Start this challengeNobody has solved this one yet — be the first clear on the leaderboard.
Open the challenge and an in-page editor appears — write your answer and tmpfs.tech grades it server-side against the same checks a real box would run. No VM, no install, no signup needed to try.
Authorized local-privilege-escalation wargames on a disposable box you own.
See all Offensive Lab challenges →
Is it free? Yes — play as a guest, no signup required to start.
Do I need to install anything? No. Everything runs in your browser.
How is it graded? Automatically and deterministically — your work is checked against the exact rules the live box would apply.