Offensive Lab

Authorized local-privilege-escalation wargames on a disposable box you own.

45 challenges · 12 easy · 23 medium · 10 pro

• Capture the flag via a SUID binaryeasy
  This is your own disposable practice box. /root/flag.txt is readable only by root. Someone left a misconfigured SUID-root binary on the system — abuse it to read the flag and write its contents to /home/player/flag.
• SUID base64 read-backeasy · in-browser
  Your own disposable practice box. /usr/bin/base64 is installed SUID-root, so it can read files only root may read. Because base64 itself cannot print plaintext, the trick is to base64-encode the protected file as root and decode the result back to plaintext. Write /home/player/ans.txt with a single pipeline that runs base64 on /root/flag.txt, pipes the encoded output to base64 with a decode flag (-d or --decode), and redirects the recovered plaintext into /home/player/flag. (Authored config, graded structurally — the engine isn't run here.)
• SUID cpeasy
  Your own disposable practice box. A SUID-root copy of cp is in /usr/local/bin. Read /root/flag.txt and write it to /home/player/flag.
• SUID ddeasy
  Your own disposable practice box. A SUID-root copy of dd is in /usr/local/bin. Read /root/flag.txt and write it to /home/player/flag.
• SUID findeasy
  Your own disposable practice box. A SUID-root copy of find was left in /usr/local/bin. Read /root/flag.txt and write it to /home/player/flag.
• SUID headeasy
  Your own disposable practice box. A SUID-root copy of head is in /usr/local/bin. Read /root/flag.txt and write it to /home/player/flag.
• SUID man pager escapeeasy · in-browser
  Your own disposable practice box. /usr/bin/man is installed SUID-root and uses an interactive pager (less). Inside the pager you can run a shell command with '!' and it executes as root. Write /home/player/ans.txt with the exact two-line answer: first the command that opens any man page (e.g. man man), then on the next line the pager escape '!cat /root/flag.txt > /home/player/flag'. (Authored config, graded structurally — the engine isn't run here.)
• SUID sedeasy
  Your own disposable practice box. A SUID-root copy of sed sits in /usr/local/bin. Read /root/flag.txt and write it to /home/player/flag.
• World-readable flageasy
  Your own disposable practice box. Sloppy ops left the flag world-readable. Read /root/flag.txt and write it to /home/player/flag.
• sudo cateasy
  Your own disposable practice box. player may run /usr/bin/cat as root via sudo. Read /root/flag.txt and write it to /home/player/flag.
• sudo cpeasy
  Your own disposable practice box. player may run /usr/bin/cp as root via sudo. Read /root/flag.txt and write it to /home/player/flag.
• sudo env exec shelleasy · in-browser
  Your own disposable practice box. sudo -l shows a NOPASSWD rule for /usr/bin/env. env will exec any program you name after it, and that program inherits root. Write /home/player/ans.txt with a single command that runs env through sudo and has it exec /bin/sh or /bin/bash so you obtain a root shell. (Authored config, graded structurally — the engine isn't run here.)
• Escalate through a sudo rulemedium
  Your own practice box. The unprivileged player account was granted a careless sudo rule. Use it to read the root-only /root/flag.txt and write the flag to /home/player/flag.
• Group-readable flagmedium
  Your own disposable practice box. The flag is group-readable by a group the player is in. Read /root/flag.txt and write it to /home/player/flag.
• SUID bashmedium
  Your own disposable practice box. There is a SUID-root shell at /usr/local/bin/rootbash. Read /root/flag.txt and write it to /home/player/flag.
• SUID cp planted root shellmedium · in-browser
  Your own disposable practice box. /usr/bin/cp is installed SUID-root, so it can write files owned by root anywhere and the copy keeps root ownership. The plan: copy /bin/bash to a file you control, then give that copy the setuid bit so it runs as its root owner. Write /home/player/ans.txt with the two-step command line: first cp /bin/bash to /home/player/rootbash, then set the SUID permission bit on /home/player/rootbash (chmod 4755 or chmod u+s). (Authored config, graded structurally — the engine isn't run here.)
• SUID cutmedium
  Your own disposable practice box. A SUID-root copy of cut is in /usr/local/bin. Read /root/flag.txt and write it to /home/player/flag.
• SUID grepmedium
  Your own disposable practice box. A SUID-root grep is at /usr/local/bin/xgrep. Read /root/flag.txt and write it to /home/player/flag.
• SUID nmap interactivemedium · in-browser
  Your own disposable practice box. The old binary /usr/bin/nmap is installed SUID-root and supports the legacy --interactive mode, whose internal '!' shell-escape therefore runs as root. Write /home/player/ans.txt containing the exact two-line answer: first the command that launches nmap in interactive mode, then on the next line the interactive '!' escape that copies /root/flag.txt to /home/player/flag (e.g. !cat /root/flag.txt > /home/player/flag). (Authored config, graded structurally — the engine isn't run here.)
• SUID pythonmedium
  Your own disposable practice box. A SUID-root python interpreter is at /usr/local/bin/xpy. Read /root/flag.txt and write it to /home/player/flag.
• SUID tailmedium
  Your own disposable practice box. A SUID-root copy of tail is in /usr/local/bin. Read /root/flag.txt and write it to /home/player/flag.
• SUID xxd hex round-tripmedium · in-browser
  Your own disposable practice box. /usr/bin/xxd is installed SUID-root and can therefore hexdump root-only files. Like base64, you recover plaintext by dumping as root then reversing the hex. Write /home/player/ans.txt with a single pipeline that hexdumps /root/flag.txt with xxd, pipes it to xxd with the reverse flag (-r), and redirects the reconstructed plaintext into /home/player/flag. (Authored config, graded structurally — the engine isn't run here.)
• Writable-PATH binary hijackmedium · in-browser
  Your own disposable practice box. A root cron job (or a SUID wrapper) runs the bare command backup instead of an absolute path, and /home/player appears in PATH ahead of /usr/bin. So a script you place at /home/player/backup runs as root when the job fires. Author the file /home/player/backup: a /bin/sh script (shebang on line one) whose body copies /root/flag.txt to /home/player/flag and makes that copy world-readable with chmod so you can read it afterwards. (Authored config, graded structurally — the engine isn't run here.)
• sudo awkmedium
  Your own disposable practice box. player may run /usr/bin/awk as root via sudo. Read /root/flag.txt and write it to /home/player/flag.
• sudo chmodmedium
  Your own disposable practice box. player may run /usr/bin/chmod as root via sudo. Read /root/flag.txt and write it to /home/player/flag.
• sudo chownmedium
  Your own disposable practice box. player may run /usr/bin/chown as root via sudo. Read /root/flag.txt and write it to /home/player/flag.
• sudo ddmedium
  Your own disposable practice box. player may run /usr/bin/dd as root via sudo. Read /root/flag.txt and write it to /home/player/flag.
• sudo envmedium
  Your own disposable practice box. player may run /usr/bin/env as root via sudo. Read /root/flag.txt and write it to /home/player/flag.
• sudo findmedium
  Your own disposable practice box. player may run /usr/bin/find as root via sudo. Read /root/flag.txt and write it to /home/player/flag.
• sudo flock shellmedium · in-browser
  Your own disposable practice box. sudo -l shows you may run /usr/bin/flock as root with NOPASSWD. flock takes a lock file followed by a command to execute while holding the lock, and that command inherits root. Write /home/player/ans.txt with a single command that runs flock through sudo on any lock path (e.g. /tmp/x) and executes /bin/sh or /bin/bash as the locked command. (Authored config, graded structurally — the engine isn't run here.)
• sudo perl shellmedium · in-browser
  Your own disposable practice box. sudo -l shows a NOPASSWD rule for /usr/bin/perl. perl can execute inline code with -e, including spawning a shell, all as root. Write /home/player/ans.txt with a single command that runs perl through sudo with a -e program that uses exec to launch /bin/sh or /bin/bash. (Authored config, graded structurally — the engine isn't run here.)
• sudo ruby shellmedium · in-browser
  Your own disposable practice box. sudo -l shows a NOPASSWD rule for /usr/bin/ruby. ruby evaluates inline code with -e and inherits root from sudo. Write /home/player/ans.txt with a single command that runs ruby through sudo with a -e program that uses exec to launch /bin/sh or /bin/bash. (Authored config, graded structurally — the engine isn't run here.)
• sudo sedmedium
  Your own disposable practice box. player may run /usr/bin/sed as root via sudo. Read /root/flag.txt and write it to /home/player/flag.
• sudo vi escapemedium
  Your own disposable practice box. player may run /usr/bin/vi as root via sudo. Read /root/flag.txt and write it to /home/player/flag.
• sudo vim ex commandmedium · in-browser
  Your own disposable practice box. sudo -l shows a NOPASSWD rule for /usr/bin/vim. vim can run an ex/shell command non-interactively with -c, executing it as root. Write /home/player/ans.txt with a single command that runs vim through sudo with a -c argument containing the ex command ':!cat /root/flag.txt > /home/player/flag' (you may add a second -c to quit, e.g. -c ':q!'). (Authored config, graded structurally — the engine isn't run here.)
• Abuse a writable /etc/passwdpro
  Your own practice box. Someone made a classic mistake on this host's account database. Exploit it to gain UID 0, read /root/flag.txt, and write the flag to /home/player/flag.
• Capability cap_setuid on pythonpro · in-browser
  Your own disposable practice box. getcap shows /usr/bin/python3 carries the file capability cap_setuid+ep, which lets the process set its own UID to 0 without being SUID. Write /home/player/ans.txt with a single python3 -c one-liner that imports os, calls os.setuid(0) to become root, then uses os.system to copy /root/flag.txt to /home/player/flag. (Authored config, graded structurally — the engine isn't run here.)
• SUID gdb call systempro · in-browser
  Your own disposable practice box. /usr/bin/gdb is installed SUID-root, so any debugger expression it evaluates runs with root privileges. Write /home/player/ans.txt with the single non-interactive gdb command line that, without loading init files, evaluates the inferior-call expression call (int)system("cat /root/flag.txt > /home/player/flag") and then quits. Include the gdb invocation, a -nx or -batch flag, and the -ex expression. (Authored config, graded structurally — the engine isn't run here.)
• sudo LD_PRELOADpro · in-browser
  Your own disposable practice box. The sudoers file keeps LD_PRELOAD in the environment (env_keep += "LD_PRELOAD") for a NOPASSWD rule that lets you run /usr/bin/somebin as root. You have compiled a malicious shared object at /home/player/evil.so whose constructor spawns a root shell. Write /home/player/ans.txt with the single command that runs the allowed binary under sudo while setting LD_PRELOAD to /home/player/evil.so so your library loads inside the root process. (Authored config, graded structurally — the engine isn't run here.)
• sudo a writable scriptpro
  Your own disposable practice box. player may run /opt/maint.sh as root via sudo — and that script is world-writable. Read /root/flag.txt and write it to /home/player/flag.
• sudo bashpro
  Your own disposable practice box. player may run /bin/bash as root via sudo. Read /root/flag.txt and write it to /home/player/flag.
• sudo make recipepro · in-browser
  Your own disposable practice box. sudo -l shows a NOPASSWD rule for /usr/bin/make. make runs the shell commands inside a recipe as root, and you can feed it a makefile from standard input (-f /dev/stdin) or an inline recipe. Write /home/player/ans.txt with a single command that runs make through sudo and supplies a recipe (via -f /dev/stdin with a here-string/heredoc, or --eval) whose command copies /root/flag.txt to /home/player/flag. (Authored config, graded structurally — the engine isn't run here.)
• sudo pythonpro
  Your own disposable practice box. player may run python3 as root via sudo. Read /root/flag.txt and write it to /home/player/flag.
• sudo shpro
  Your own disposable practice box. player may run /bin/sh as root via sudo. Read /root/flag.txt and write it to /home/player/flag.
• sudo tar checkpointpro
  Your own disposable practice box. player may run /usr/bin/tar as root via sudo. Read /root/flag.txt and write it to /home/player/flag.