Bastion

There are no SUID surprises and no writable cron jobs here. Instead, look at what you're explicitly permitted to run as someone else. Sometimes the privilege escalation isn't a vulnerability at all — it's a policy someone configured too generously.

For Root-Flag when you land in a restricted shell that blocks commands, examine allowed utility list carefully. Interpreters left available frequently include built-in functions capable of spawning unrestricted execution contexts.