SITUATION

The file upload exploit from the previous phase landed a shell as www-data on 10.10.16.10. This is a low-privilege service account. Your objective is to enumerate the system, identify a privilege escalation path, and escalate to root.

CURRENT ACCESS

METHODOLOGY

• Start with basic enumeration — who are you, what OS, what kernel
• Check sudo permissions — can www-data run anything as root?
• Find SUID binaries — executables that run as their owner (often root)
• Check cron jobs — scheduled tasks running as root with writable scripts
• Look for writable files in sensitive locations
• Consult GTFOBins for exploitation techniques

GOAL

Achieve a root shell and read /root/flag.txt.