We can get the first flag by connecting with netcat and printing the evnironmental variables with `env`
<imgsrc="https://i.imgur.com/iBZ0c0T.png"/>
## Privilege Escalation (curiosity)
On runnning `sudo -l` we can see that opportunity user can run `ls` binary as `curiosity`
<imgsrc="https://i.imgur.com/3AAl8Bd.png"/>
<imgsrc="https://i.imgur.com/gyyBC3n.png"/>
Using this flag we can switch to curiosity user
## Privilege Escalation (insight)
Running `sudo -l` to see what we can run as other user , it seems that there's a custom binary named `insight`
<imgsrc="https://i.imgur.com/CiDsC1s.png"/>
On running this binary , it will print this message
<imgsrc="https://i.imgur.com/scL7NIW.png"/>
Let's transfer this binary on to our host machine so that we can analyze what's going on in this binary
<imgsrc="https://i.imgur.com/at9i510.png"/>
I used `ghidra` to analyze the binary , looking at the `main` function it's just setting the uid,gid and eid to 1005 (pathfinder user's id) and just printing a string
<imgsrc="https://i.imgur.com/Cwld3CE.png"/>
But we can see here that a shared library is being used , shared library is loaded by the program when it starts
<imgsrc="https://i.imgur.com/cERe1ED.png"/>
By following this article https://www.hackingarticles.in/linux-privilege-escalation-using-ld_preload/ , I used the same c langugage code , changed the root's id to insight's id which was 1004
```c
#include <stdio.h>
#include <sys/types.h>
#include <stdlib.h>
void _init() {
unsetenv("LD_PRELOAD");
setgid(1004);
setuid(1004);
system("/bin/sh");
}
```
Now to compile this
<imgsrc="https://i.imgur.com/dsCOTSI.png"/>
Host the shared object file and transfer it to the target machine
<imgsrc="https://i.imgur.com/wNjeIUx.png"/>
<imgsrc="https://i.imgur.com/FsKgQe4.png"/>
## Privilege Escalation (pathfinder)
Running `sudo -l` again , we can see this user can run `pathfinder` binary , another custom binary
<imgsrc="https://i.imgur.com/4GRQYzf.png"/>
on running this in a directory where we don't have permissions to read file , it will give us an error that `ls` cannot open directory , which means that ls binary is being used here and it's possible that it isn't using it's absolute path i.e `/bin/ls` , here comes PATH variable exploit in which we create a fake `ls` binary which will invoke `bash` and for that we will need to add the path for our fake binary
<imgsrc="https://i.imgur.com/DZXyd8y.png"/>
## Privilege Escalation (ETSCTF)
Doing `sudo -l` with this user will show us that we can run `/usr/bin/env` which is used to print environmental variables as `ETSCTF` user