> For the complete documentation index, see [llms.txt](https://666isildur.gitbook.io/ethical-hacking/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://666isildur.gitbook.io/ethical-hacking/tryhackme/linux-privesc-playground.md). # Linux Privesc Playground ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7TmWsYpZUGClZaI-bX%2Fimage.png?alt=media\&token=5f346702-db49-4618-a0ef-32619c8e9b76) All the files with SUID bit set that belong to root: ``` -bash-4.2$ find / -user root -perm /4000 2>/dev/null /usr/sbin/arp /usr/sbin/node /usr/sbin/pppd /usr/lib/eject/dmcrypt-get-device /usr/lib/pt_chown /usr/lib/dbus-1.0/dbus-daemon-launch-helper /usr/lib/openssh/ssh-keysign /usr/bin/wget /usr/bin/cut /usr/bin/base64 /usr/bin/traceroute6.iputils /usr/bin/tail /usr/bin/aria2c /usr/bin/ul /usr/bin/shuf /usr/bin/php5 /usr/bin/gpasswd /usr/bin/make /usr/bin/openssl /usr/bin/file /usr/bin/tclsh8.5 /usr/bin/env /usr/bin/diff /usr/bin/watch /usr/bin/strace /usr/bin/rlwrap /usr/bin/expand /usr/bin/fold /usr/bin/vim.basic /usr/bin/timeout /usr/bin/xargs /usr/bin/expect /usr/bin/chsh /usr/bin/jq /usr/bin/perl5.14.2 /usr/bin/readelf /usr/bin/sudo /usr/bin/ionice /usr/bin/sudoedit /usr/bin/unshare /usr/bin/time /usr/bin/taskset /usr/bin/mtr /usr/bin/emacs23-x /usr/bin/flock /usr/bin/tee /usr/bin/xxd /usr/bin/setarch /usr/bin/python2.7 /usr/bin/uniq /usr/bin/head /usr/bin/sort /usr/bin/newgrp /usr/bin/stdbuf /usr/bin/nl /usr/bin/perl /usr/bin/tftp /usr/bin/find /usr/bin/passwd /usr/bin/rsync /usr/bin/docker /usr/bin/pg /usr/bin/fmt /usr/bin/nice /usr/bin/od /usr/bin/chfn /usr/bin/gimp-2.6 /usr/bin/gdb /usr/bin/unexpand /sbin/dmsetup /sbin/start-stop-daemon /sbin/logsave /bin/sed /bin/mount /bin/mv /bin/cp /bin/dash /bin/ksh93 /bin/chmod /bin/ping /bin/chown /bin/fusermount /bin/bash /bin/nano /bin/ip /bin/more /bin/cat /bin/zsh4 /bin/less /bin/su /bin/busybox /bin/dd /bin/grep /bin/run-parts /bin/ping6 /bin/date /bin/bsd-csh /bin/umount ``` All the binaries that can be exploited in the list above: ``` arp node wget cut base64 tail ul aria2c shuf php5 make openssl file tclsh env diff watch strace rlwrap expand fold vim xargs timeout expect jq perl readelf ionice time unshare taskset mtr emacs flock tee xxd setarch python uniq sort head stdbuf nl tftp find rsync pg docker fmt nice od gdb gimp unexpand dmsetup start-stop-daemon sed mount logsave mv dash cp ksh chmod chown bash nano more ip cat zsh less busybox dd grep run-parts date ``` ## arp ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7TruMOQ7EgovOV9oOA%2Fimage.png?alt=media\&token=4e036a70-467c-4957-a663-92127a61bcf3) ## cut ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7Tt1RQgB38Y1Kh1h2C%2Fimage.png?alt=media\&token=6a3896fc-c3df-40d8-aa06-7012abad0d49) ## base64 ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7TtRBaWTq2Aa09eobG%2Fimage.png?alt=media\&token=c262dcd3-947f-4ed1-b399-c025bc0de6ac) ## tail ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7TtkmpQsx8ZUyi9HaF%2Fimage.png?alt=media\&token=22a685aa-a8c5-4777-aa2f-5380e026e0ff) ## ul ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7TtwSoZIvXsESZXZ8_%2Fimage.png?alt=media\&token=9874d0c5-fcce-430b-8dab-0e698c913f01) ## shuf ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7Tv-20jmtrQ3lFtU3t%2Fimage.png?alt=media\&token=97e81018-3848-4a16-9cf3-65468e43c6a9) ## php ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7TvResvtdPc6X-4XnR%2Fimage.png?alt=media\&token=14953c44-6be7-4f3d-8c5f-208dbc489f1a) ## openssl ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7Tw3fkPUUUQnbkqM0I%2Fimage.png?alt=media\&token=f9f917e0-a430-40c2-aeb1-9695355e65ef) ## file ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7TwMOo-zkbzXzOmRcf%2Fimage.png?alt=media\&token=9c90207d-1810-4b9a-9eaa-96dcf84affca) ## tclsh ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7TwbyxoQj4YYDrj3TS%2Fimage.png?alt=media\&token=c4eb3cab-7949-409c-ac8e-71fc9636f334) ## env ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7Twveh-7Vk5pm5iUf3%2Fimage.png?alt=media\&token=5f0356ea-de32-4a95-a28e-569ab0e6fb10) ## diff ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7Tx6hV7n6Yphi2shDw%2Fimage.png?alt=media\&token=50a8015b-de0b-4ad9-b350-01ff16faa574) ## strace ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7Txu7ZLqnY7N0tJYsx%2Fimage.png?alt=media\&token=ddf4a0a1-9835-4faf-9b7d-1713067035cf) ## rlwrap ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7Ty4gyq-Yy874kioN3%2Fimage.png?alt=media\&token=e6a8533d-2bfd-420c-9bc1-e7b001425dcc) ## expand ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7Tyaddi_fc9fVrgMxR%2Fimage.png?alt=media\&token=922556e0-e554-4826-91bb-4bf969b3b8dc) ## fold ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7TypMaV6S8XOPSklVe%2Fimage.png?alt=media\&token=ec64b765-0ad3-487b-a6c7-1a3beea1420e) ## vim `vim /root/flag.txt` ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7TzF6gupNnkFjiqh7-%2Fimage.png?alt=media\&token=8d6f4186-2f3e-415a-b88c-73ab483050e4) getting a shell ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7TzUTGFD1EQr0iAj6I%2Fimage.png?alt=media\&token=4be367ba-8897-4587-9644-ce7462624946) ## xargs ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7TzyN8JzzyCuKVeJjA%2Fimage.png?alt=media\&token=1f970330-0566-401f-8be6-f2f351af08ff) getting a shell ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7U-9Nl--ADlUeRfbQe%2Fimage.png?alt=media\&token=61948375-7922-4c24-8542-24a49825fde4) ## timeout ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7U-ObnLU_flRrsyB2z%2Fimage.png?alt=media\&token=641541f5-fc2f-4ed8-a3ed-064cc02b8838) ## expect ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7U-m8TNa72BC-_LaC8%2Fimage.png?alt=media\&token=af094d0c-57cc-40ce-a4ef-a74251feffe1) ## jq ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7U0GIub46N_usVq709%2Fimage.png?alt=media\&token=d0667c22-a300-4da8-bbb6-1f404afd9508) ## readelf ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7U1BzZUxYv5dRWgTNg%2Fimage.png?alt=media\&token=b1c9f3ec-d818-4f14-be82-91c00067d33b) ## ionice ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7U1Y7HE2nl11Zj7Aiq%2Fimage.png?alt=media\&token=e784171b-39d7-46c8-85de-055944b3e277) ## time ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7U1ow_un7vF_QtLuKL%2Fimage.png?alt=media\&token=a792fe90-a316-4cb2-bc1a-7212c5776a8b) ## unshare ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7U229_K7a1QccUhCjg%2Fimage.png?alt=media\&token=d13c4291-6f86-46a6-8d8c-e17334d2259f) ## taskset ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7U2KLXjpI9Dc7NS0Us%2Fimage.png?alt=media\&token=808d6ffc-904e-4807-8e26-4b7506a3a5e5) ## emacs `emacs /root/flag.txt` ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7U2sxupyKwtlP7hLv8%2Fimage.png?alt=media\&token=0d49a526-e906-481c-8972-e6a1f2e79209) getting a shell `emacs -Q -nw --eval '(term "/bin/sh")'` ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7U39CM3qxsDr4DUlqG%2Fimage.png?alt=media\&token=d3d7a0af-dfb6-412c-a1ae-2b990ce9c4d7) ## flock ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7U3iX3ZWeHBnnIIXp0%2Fimage.png?alt=media\&token=316b5d27-5c9e-475b-bb2c-174ca5fc60b2) ## xxd ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7U4-OnBJdS4cE177rC%2Fimage.png?alt=media\&token=8d4b8b06-afb1-4086-b120-560673e78fd6) ## setarch ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7U4J_WXolVGTewg78V%2Fimage.png?alt=media\&token=819bc7ed-eaab-425f-99ec-75a01dc5935c) ## python ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7U4bEQnal47OQJwyuX%2Fimage.png?alt=media\&token=faa8dbbf-9cf1-4e17-bcdd-8566c16cfc5a) getting shell ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7U4o9eXZTzbMVjDK8O%2Fimage.png?alt=media\&token=9538943d-af5f-428d-9351-315f97a5e438) ## uniq ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7U5EkUMn6ETxGAxbZ9%2Fimage.png?alt=media\&token=d17380df-555b-475b-8480-1ea594d7e1c4) ## sort ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7U5TVsLTIsiP2gr-wn%2Fimage.png?alt=media\&token=4cb6ce27-e8b6-474f-b5a6-608a377982c3) ## head ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7U5jKzwg6z11F2u-fn%2Fimage.png?alt=media\&token=7f16bff5-8fc0-4590-ae6c-91ba7cdaee55) ## stdbuf ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7U5vm_3Klg1YCkrF6K%2Fimage.png?alt=media\&token=80b229bd-2416-410c-bf11-d969238fbaed) ## nl ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7U6SM7GqEBZ2t5xL-L%2Fimage.png?alt=media\&token=7e0ee829-85d3-4d65-a90e-d4d9f8d7cc00) ## find ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7U6wAm2RVtO7gWQsYy%2Fimage.png?alt=media\&token=006e0244-bf7d-4e5d-b289-77b12f8bbba7) getting shell ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7U79uKLSS-sOc95BWm%2Fimage.png?alt=media\&token=a6192c85-ecda-4dcd-be51-656d92eb4cf4) ## rsync ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7U7YqXkL1VM1RzGZbZ%2Fimage.png?alt=media\&token=281cf3c0-4801-4d80-a09d-acabec81cb66) ## pg ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7U7k2R1lEfbIIBCyQh%2Fimage.png?alt=media\&token=2750e2ff-8bf8-419b-938a-0d8f66e5c47a) getting shell ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7U83NlTcOyEhZTkn7f%2Fimage.png?alt=media\&token=59f74775-c41b-463c-8293-a8e9f7835294) ## fmt ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7U8UErq-ablgyl1Xby%2Fimage.png?alt=media\&token=b02ebd5c-cf1d-4e2b-bb6d-6e37ac1124ad) ## nice ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7U8gBaqvUeRd2fek9Q%2Fimage.png?alt=media\&token=11db002c-346f-48fc-a9c0-811f76b9a746) ## od ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7U9-jKS7Vxe6f3bo9E%2Fimage.png?alt=media\&token=71d7d818-dda1-41eb-98f8-b6072d9a5f41) ## gdb ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7U9UlB5uz-kX-4F0mr%2Fimage.png?alt=media\&token=9c1bda46-3c5a-4a6b-bdaf-7d7338855e36) ## unexpand ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7U9s_rcEThJp4Uwcc9%2Fimage.png?alt=media\&token=ec867b47-83f9-4568-a23d-60ce94d01085) ## start-stop-daemon ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7UF2yFvbf9ozBdTIVX%2Fimage.png?alt=media\&token=8b7bac88-f04a-423a-9ebc-e9edfec5f3c1) ## sed ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7UFEmCPqgosSpxQgVI%2Fimage.png?alt=media\&token=cb998195-6468-4952-a15a-5b21268b80dc) getting shell ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7UFZ2pk-CU6qR3ZYrX%2Fimage.png?alt=media\&token=5b5b0cf1-b5d4-4348-b38b-7d3062ef782b) ## logsave ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7UFkuH6s6KpcQDgpNA%2Fimage.png?alt=media\&token=8a21ea0a-4ef2-464a-a2a0-9dbd182e61b0) ## dash ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7UG5g8jaqIfxmJoJqN%2Fimage.png?alt=media\&token=f1cd6baf-225a-4b04-86fa-c7d94fe75586) ## cp ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7UGP2P96jxMhdji85p%2Fimage.png?alt=media\&token=f6f1b2ee-64cd-48ff-b458-06c64defb785) ## ksh ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7UGfsyfhMljTWk506b%2Fimage.png?alt=media\&token=c58b75ab-29b5-4fb6-b3d9-c649187d0a0f) getting shell ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7UGo4BrbZHCE8XW4Xk%2Fimage.png?alt=media\&token=b2871d3d-1ee5-4188-82ea-ddda87ec1082) ## bash ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7UHG4tBXnolfzBXhBo%2Fimage.png?alt=media\&token=f640e03d-2986-4764-9ba0-46099ac1038c) ## more ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7UHiTADb6bZjKV_MPh%2Fimage.png?alt=media\&token=11aba24b-2e30-4318-95b4-f004b7b6ccb1) ## ip ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7UHuf4qTCFiXFur5CC%2Fimage.png?alt=media\&token=55a1c1fd-ec04-44fd-9e91-c5aa3046b7f6) ## cat ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7UI53F5rnAahOY9SN-%2Fimage.png?alt=media\&token=bb1a6a68-8c9e-419d-935b-eee3deabc31f) ## zsh ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7UIHQNrEgvu-qUZN7e%2Fimage.png?alt=media\&token=42c87cc1-a548-4517-934d-1b8bc05942a4) ## less `less /root/flag.txt` ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7UIZ3IBg1GcV6Ung5N%2Fimage.png?alt=media\&token=ee2b4d4a-5c47-43e9-bdf9-ac7f3d2408b7) ## dd ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7UIwGODsvb8P-DVUUj%2Fimage.png?alt=media\&token=0d7980cf-b76d-4a09-8afb-79d21ed8414b) ## grep ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7UJ3xEND9OgNLKKeH5%2Fimage.png?alt=media\&token=dd548640-17be-4be4-8f38-92a54e61a23b) ## run-parts ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7UJGeF5aFx5gUfqZp1%2Fimage.png?alt=media\&token=0abafaac-bf70-487c-bd5c-53fd9f73b280) ## date ![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7T6gjTndJJnbBKsQY6%2F-M7UJPme-LP4QurSMzch%2Fimage.png?alt=media\&token=99137bc6-cff1-4ec4-bbf9-eb2c031241d6)