Phantom Track
Level 4 → Level 5
Misplaced Power
ACT I380 pts+50 first-blood bonus
★ This level now runs on an isolated ephemeral box
L4 moved to a per-session phantom-deep ephemeral on 2026-07-07 so the real Linux-capability privesc (cap_setuid on an interpreter) can't be skipped with full root. Connect with: ssh [email protected] -p 2229 (use your L3 flag as the password). Same challenge, same flag, same fingerprint, same points. This is still a required chain hop — read the L4 flag, then continue with phantom5 exactly as before.
Mission
Find a Linux capability granted to a scripting-language interpreter and abuse it to become root.
Why this matters in 2026
Capabilities replace SUID but are rarely audited. One misplaced privilege on an interpreter binary = full root.
Mitigation era: 2026-04 · rotation policy: levels may be refreshed as CVEs are patched out of distro defaults.
Connection Terminal
Use the password forphantom4 that you captured on the previous level, then:ssh [email protected] -p 2229SSH command copied to clipboard!
🩸
ACTIVE RECORDFirst Blood captured by