PicoCTF “Sudo Make Me a Sandwich” Writeup — Privilege Escalation Explained

When you start the instance, you’ll see the connection details provided by PicoCTF.

🔐 Step 1: Connect via SSH

Use the SSH command and password shown on the challenge page to connect to the target machine.

ok this is how you connect

📂 Step 2: Enumerate Files

After logging in, list the files:

ls

You’ll notice a file named **flag.txt**.

Now check its permissions:

ls -l

🧠 Understanding the Permissions

• -r--r----- means:
• Owner → read
• Group → read
• Others → no permission
• root root means:
• Owner = root
• Group = root

👉 Since you are not root, you cannot read the file, and attempting to do so will result in Permission Denied.

🔍 Step 3: Check Sudo Privileges

now let's list the privileges using ‘sudo -l’ command

• (ALL) → You can run the command as any user (including root)
• NOPASSWD → No password required when using sudo
• /bin/emacs → The only command you’re allowed to run with sudo is Emacs

that means You can run the Emacs editor as root without entering a password

🚨 Step 4: Exploiting the Misconfiguration

so i visited gtfobins website GTFOBins is a curated collection of Unix-like executables that can be abused to bypass security restrictions, escalate privileges, or escape restricted shells.

I searched ‘emacs’ in the website and copied the sudo code as shown below

then I entered the code with sudo as shown below

⚡ Step 5: Root Access

woilah I am now root

as shown below

Now you know what to do Right?

I think this is helpful

Thank you.