← Learn
Dangerous
cp /bin/sh /tmp/.cache && chmod u+s /tmp/.cache

linux · bash · Nightmare

Copies a shell to a hidden file and sets it setuid, leaving a binary that grants the copying user's privileges to anyone who runs it. If it was created by root, any local account now has a permanent route to a root shell.

Signals to notice

  • Setuid bit on a shell binary
  • Hidden filename in a world-writable directory
  • Creates a durable privilege escalation path

Think you can spot these under time pressure?

Start Training

More Privilege Escalation