If I have access to .bashrc -> .profile for another user which is owned by root with lrwxrwxrwx permissions

How could I capture /root/flag.txt? It's a Live CD.


  • 2
    This is obviously a CTF exercise. You include some VERY important details in your comments below that you need to edit into to your question.
    – schroeder
    Feb 8, 2016 at 21:45
  • 1
    There are tons of things the designer of the CTF might have expected. There are known vulnerabilities in symlinks in some kernel versions. We don't know what else the fake system and fake processes do. We would need a lot more context.
    – schroeder
    Feb 8, 2016 at 21:49

1 Answer 1


Let me make sure I understand the question properly: if you have write access to another user's .bashrc and/or .profile then you can plant any arbitrary code to be executed by them the next time they launch a shell / login, right? So why not add the following line to .bashrc / .profile

cp /root/flag.txt /home/<your_user>

or if you want to leave less of a paper trail:

chmod o+rw /root/flag.txt
  • I should be more clear - it's a Live CD I'm on as it's a test, so another user won't login. I was thinking of symlinking my bashrc to their profile... but is that too stupid?
    – pee2pee
    Feb 8, 2016 at 20:58
  • hmm, I don't know then. The point is that the code has to be executed by their user, right? Feb 8, 2016 at 21:01
  • @pee2pee Without knowing the ins and outs of this particular CTF, this is the generic answer.
    – schroeder
    Feb 8, 2016 at 21:49

Not the answer you're looking for? Browse other questions tagged or ask your own question.