tmpfs.tech · all tracks · Offensive Lab

SUID nmap interactive

Offensive Lab · medium · solved in-browser (no VM needed) · 3 tiered hints

Your own disposable practice box. The old binary /usr/bin/nmap is installed SUID-root and supports the legacy --interactive mode, whose internal '!' shell-escape therefore runs as root. Write /home/player/ans.txt containing the exact two-line answer: first the command that launches nmap in interactive mode, then on the next line the interactive '!' escape that copies /root/flag.txt to /home/player/flag (e.g. !cat /root/flag.txt > /home/player/flag). (Authored config, graded structurally — the engine isn't run here.)

▶ Start this challenge

Nobody has solved this one yet — be the first clear on the leaderboard.

How it works

Open the challenge and an in-page editor appears — write your answer and tmpfs.tech grades it server-side against the same checks a real box would run. No VM, no install, no signup needed to try.

More Offensive Lab challenges

Authorized local-privilege-escalation wargames on a disposable box you own.

• Capture the flag via a SUID binaryeasy
• SUID base64 read-backeasy · in-browser
• SUID cpeasy
• SUID ddeasy
• SUID findeasy
• SUID headeasy
• SUID man pager escapeeasy · in-browser
• SUID sedeasy

See all Offensive Lab challenges →

FAQ

Is it free? Yes — play as a guest, no signup required to start.

Do I need to install anything? No. Everything runs in your browser.

How is it graded? Automatically and deterministically — your work is checked against the exact rules the live box would apply.