---
# System prepended metadata

title: babysuid write-up
tags: [pwn college]

---

###### tags: `pwn college`

# babysuid write-up

## level 40

This challenge require us to use `mv` command to read `/flag` file. 
![](https://i.imgur.com/bgcz5cA.png)

### First
We already got SUID bit on the `mv` command. So the `/challenge/babysuid_level40` file actually set permission on file with the same name as `/usr/bin/mv` file.
So i change the name of `cat` command into `mv` command.

![](https://i.imgur.com/fL5GM8Z.png)

Then I rerun the `/challenge/babysuid_level40` file.


This does set the SUID bit into the 'usr/bin/mv' file. But underneath it lies the cat command.

### Second
I use the `cat` command (which is now the `mv` command) to print the `/flag` file.

![](https://i.imgur.com/XjdMsga.png)

This will gives us the flag.


