PATH Hijacking
Log in over SSH with jprhack / jprhack_p@newd! to a small internal backup server. The only exposed service is SSH — no web app, no sudoers tricks. On the box there's a binary with the SUID bit set — find it, analyze it, and spot that one of its code paths invokes a command without an absolute path. Abuse that to pull off a PATH hijacking attack, land a root shell, and grab the flag at /root/root.txt.
# 1. Extract the archive you just downloaded — on your own box, not a server.
you@host:~$ unzip path-hijacking.zip && cd path-hijacking
# 2. Boot the vulnerable machine. It prints the IP it was assigned.
you@host:~$ sudo bash deploy.sh path-hijacking.tar
# 3. Point your tools at that IP. Ctrl+C here tears it back down when you're done.
Submit flags
Log in to submit flags and track your progress.