← Back to SAVARA FEST CTF

FLAG 5 - PRIVILEGE ESCALATION TO USER3

Switch to the devs group to read user3 files and extract the flag.

Tools Used

newgrpLinux Permissions

Overview

Having spawned a shell as user2, we look for paths to access the user3 user home directory.

Reconnaissance

Checking the directory permissions on /home/user3, we find it is readable by members of the group devs:

drwxr-x--- user3 devs /home/user3

Exploitation Strategy

Although we are user2, our current active group ID does not match. We use the command newgrp devs to switch our group context to devs, which immediately permits us to enter /home/user3 and retrieve flag 5.

Solution Code

newgrp devs
cd /home/user3
cat flag5.txt

Flag

Dynamic Flag (User 3 devs flag)