> For the complete documentation index, see [llms.txt](https://thmflags.gitbook.io/thm-walkthroughs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://thmflags.gitbook.io/thm-walkthroughs/difficulty-info/cve-walkthroughs/overlayfs-cve-2021-3493.md).

# OverlayFS: CVE-2021-3493

Exploit a 2021 Kernel vulnerability in Ubuntu to become root almost instantly!

{% embed url="<https://tryhackme.com/room/overlayfs>" %}
<https://tryhackme.com/room/overlayfs>
{% endembed %}

| Room Attributes       | Value                                                                  |
| --------------------- | ---------------------------------------------------------------------- |
| Subscription Required | <mark style="color:green;background-color:green;">False</mark> \[Free] |
| Type                  | Walkthrough                                                            |
| Difficulty            | <mark style="color:blue;background-color:blue;">Info</mark>            |
| Tags                  | PrivEsc, Linux, Ubuntu, Kernel, CVE-2021-3493                          |

## Task 1 - What is OverlayFS?

### I have a very rough overview of what OverlayFS is

{% hint style="success" %}
No answer needed
{% endhint %}

## Task 2 - CVE-2021-3493 - OverlayFS Exploit

### Deploy the machine with the Start Machine button in this task and wait up to 2 minutes for the VM to boot.

{% hint style="success" %}
No answer needed
{% endhint %}

### SSH into the machine with the credentials provided in the task text.

{% hint style="success" %}
No answer needed
{% endhint %}

### Grab the source code for the exploit from [SSD-Disclosure here](https://ssd-disclosure.com/ssd-advisory-overlayfs-pe/) and save it as exploit.c on the target machine.

{% hint style="warning" %}
**HINT:** Perhaps the easiest way is copy/pasting the code into a text editor like Nano or Vim!
{% endhint %}

{% hint style="success" %}
No answer needed
{% endhint %}

### Compile the exploit with gcc. If you're finding this difficult, a command is given in the hints.

{% hint style="warning" %}
**HINT:** gcc -o exploit exploit.c
{% endhint %}

{% hint style="success" %}
No answer needed
{% endhint %}

### Run your compiled exploit, and get root! What's the flag in /root/?

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`thm{27aaa5865a52dcd4cb04c0e0a2d39404}`

</details>

## Task 3 - Further reading

### Hope you've enjoyed this short room.

{% hint style="success" %}
No answer needed
{% endhint %}