Where a script hands over the keys¶

Each challenge is one small program with one bad habit: a variable that was never quoted, an input that reaches an interpreter on its way past, a sudo rule written for convenience on a Tuesday and never read again. The goal is always the next user up, usually root, and the whole surface is a few lines long. Nothing is hidden here. It is a question of noticing which line does the trusting.