I'm working on a linux privilege escalation. This is the situation: I'm able to write to /bin, and I only have sudo access to run a script. This script just prints information with an echo.

I copied /bin/bash to /bin/echo, hoping that running that sudo script would get me an elevated shell but that didin't work. After replacing /bin/echo, running "echo test" just prints "test". Doing /bin/echo whoever spawns a bash shell.

I checked that my PATH variable is correct (it includes /bin first), and I don't have an "echo" binary in any other path. Running "which echo" returns only "/bin/echo". I tried this in an Ubuntu server, and thought that maybe Apparmor had something to do, but I also tried it on a Debian without Apparmor and didin't work either.

1 Answer 1


The script is executing the shell builtin instead of /bin/bash.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.