System Persistence

hackerlab

Task: a compromised Linux server exposes SSH and a defaced web page, while /server/token.txt only reveals rotating token fragments. Solution: enumerate temporary SGID binaries owned by group hacker, preserve egid=hacker through a working wrapper, access /home/hacker/userkick, and kick the attacker account to print the real flag.