I don't want to go too far off the beaten path here and kind of stay focused on what the skill is about.
But real quick, I do want to show you that if you modify the path, you can actually have known file names,
like what we found with root having from suid flag set on those files, and kind of take over with your own files, so to speak.
And in this case, we're going to be using mount.
Now doing a directory listing of home slash learner, you can see that I've created a mount file in here.
You can take a look at it yourself in like Vim or something.
And I've already doctored it with Jamad to be able to add it to executable, as you can see right there.
And I'm in the regular terminal session.
Now, if I'm using regular mount, you can see that everything up above is normal.
But if I focus in for you real quick, you can see that I'm running the home learner mount.
And now if I go ahead and run that, you see fake mount activated, misspelled, could have been a reverse shell connection.
And by editing the path, we're taking advantage of the user and administrator's trust that the command of mount is normally a system file
that's supposed to run with root level permissions to do a specific purpose of mounting something.
And in this case, you've taken it over using a fake file.