The same thing can be done with the directories as I have the code for both above.
The reason that I exported the writable attribute to all directories in here to a file,
one, to make it easier to take a look at, and two, to get the idea that some of these are default
based on the installation of the operating system we're dealing with.
A lot of what we do is reconnaissance and getting a feel for things beforehand.
Once we find out there's Ubuntu in our actual footprint with our scope within the rules of
engagement, we can start doing our lab environment testing like so, that we're doing it here,
and get an idea for the number of directories that we can expect to have
writable permissions set on them. So that not only can we write to the actual files within,
but also start making directories and making changes to those directories on our own to be
able to put stuff into, like the fake service executables or service files that we've been
created in previous skills. Where this really comes into play at is that you can create scripts
and files that are writable inside of the files that we find already that have the right attribute
to them by everybody, or put them in directories that are already assigned with the right attribute
by everybody. And when that file is scripted, is ran, it's done under the person that actually
runs it. So if there are process IDs that are already writable, like we saw in the files output,
that we very well could write code and append it to a file in one of those proc folders,
and when it's ran, it's ran as root or whoever has the permissions that's running it. So whenever
we run, let's say, reverse shell from Metasploit and inject that code into a folder that is
writable, let's say an elevated user has gone in and run that process, and unbeknownst to them,
our malicious code is running behind the scenes. It's at their permission level. Because we've seen
in previous skills where the permission of the person that we've remoted into has restricted us
to some level of complications when it comes to trying to get more information or pivot inside of
that system. So this is a perfect opportunity for us to be able to go in and use that write ability
after doing the reconnaissance on that system to see if we can write code in elsewhere or put
different files elsewhere, like let's say a PDF or a Word document with a macro in it or something,
and then go through and have it executed by the system in a best case scenario,
or a user would just elevate a permissions after that as a second best scenario.