Bash

Theory

Bash scripting is a powerful tool used by system administrators and developers to automate tasks and streamline processes on Unix-like systems. However, like any software, bash scripts can be vulnerable to various security issues, which, if exploited, can lead to privilege escalation and unauthorized access.

Practice

Shell In Prompt

Enumerate

If a bash script executes read -p. We can input /bin/bash -i to get a shell as another user.

$ cat /usr/bin/vuln-script.sh

#!/bin/bash
read -p "What's you name: "

Exploit

Bash eq

Enumerate

If a bash script use the -eq comaparison, it's vulnerable to arbitrary command execution.

$ cat /usr/bin/vuln-script.sh

#!/bin/bash
read -rp "Enter guess: " num

if [[ $num -eq 42 ]]
then
  echo "Correct"
else
  echo "Wrong"
fi

Exploit

No Command Path Exploit

Enumerate

If a bash script executes another command without specifying the path. We can abuse it and get a privilege escalation.

$ cat /usr/bin/vuln-suid-script.sh

#!/bin/bash
ls /root/var/file

Exploit