# Snyk Fetch the Flag CTF 2023 writeup: Off the SETUID

DevFeed: [Snyk Fetch the Flag CTF 2023 writeup: Off the SETUID](<https://devfeed.tech/articles/snyk-fetch-the-flag-ctf-2023-writeup-off-the-setuid-8130.md>)

Original publisher: [Read original article](<https://snyk.io/blog/snyk-fetch-the-flag-ctf-2023-writeup-off-the-setuid/>)

Author: Carlos Polop; Yago Gutiérrez

Published: 2023-11-30T10:00:00Z

Content type: article

Language: en

Sources: [Blog RSS Feed | Snyk](<https://devfeed.tech/sources/blog-rss-feed-snyk.md>)

Topics: [snyk](<https://devfeed.tech/topics/snyk.md>), [ctf](<https://devfeed.tech/topics/ctf.md>), [Kernel](<https://devfeed.tech/topics/kernel.md>), [Processes](<https://devfeed.tech/topics/processes.md>), [qemu](<https://devfeed.tech/topics/qemu.md>), [HTTP](<https://devfeed.tech/topics/http.md>), [PHP](<https://devfeed.tech/topics/php.md>), [C](<https://devfeed.tech/topics/c.md>), [Server](<https://devfeed.tech/topics/server.md>), [Network](<https://devfeed.tech/topics/network.md>)

Tags: [awareness](<https://devfeed.tech/tags/awareness.md>), [blog](<https://devfeed.tech/tags/blog.md>), [c](<https://devfeed.tech/tags/c.md>), [compiler](<https://devfeed.tech/tags/compiler.md>), [ctf](<https://devfeed.tech/tags/ctf.md>), [developer](<https://devfeed.tech/tags/developer.md>), [external](<https://devfeed.tech/tags/external.md>), [http](<https://devfeed.tech/tags/http.md>), [kernel](<https://devfeed.tech/tags/kernel.md>), [network](<https://devfeed.tech/tags/network.md>), [php](<https://devfeed.tech/tags/php.md>), [process](<https://devfeed.tech/tags/process.md>), [qemu](<https://devfeed.tech/tags/qemu.md>), [security](<https://devfeed.tech/tags/security.md>), [server](<https://devfeed.tech/tags/server.md>), [snyk](<https://devfeed.tech/tags/snyk.md>), [writeup](<https://devfeed.tech/tags/writeup.md>)

## AI overview

This Snyk Fetch the Flag CTF 2023 writeup explains how to solve the Off the SETUID challenge. It examines a minimal QEMU environment with a custom kernel, identifies PHP code injection in an HTTP server, and describes escalating privileges to read the flag from the root user's home directory.

## Source excerpt

If you were at Snyk's 2023 Fetch the Flag and are looking for the answer to the Off the SETUID challenge, you've come to the right place. Let's walk through the solution together!