This is not an exercise, there might be no solution.
We are producing a Docker image (based on CentOS) which is designed to be executed by a non-root user. However, this user has write access to /etc/passwd because he is in "root" group. Here are /etc/passwd permissions:
-rw-rw-r-- 1 root root 692 Dec 16 14:35 /etc/passwd
This is a critical flaw and it is supposed to allow easy privilege escalation. I can add a user into /etc/passwd.
But I cannot switch to this user, because su does not have SUID permission:
-rwxr-xr-x 1 root root 32128 Sep 30 17:46 /bin/su
As a result, the user does not have enough permissions for a successful su execution:
su: cannot set groups: Operation not permitted
As I understood, on most Linux, su command is configured with SUID permission. That means that whoever executes su, it is considered to be executed by root user. Another alternative might be to play with capabilities. I suppose that CAP_SETGID and CAP_SETUID are required and maybe some others. If su was configured with those capabilities the SUID permission might not be needed. But in our Docker image, there are no capabilities on su. So it seems that only root can execute su properly.
Also, sudo is not installed and no sshd/telnetd is running.
So how can I use the credentials added to /etc/passwd? Curl is available if that can help.