Finding writable files
Once you gain access to a system, you want to start exploring. Typically, you will look for ways to escalate your privilege or maintain persistence. A great way to look for methods of persistence is to identify which files have write permissions.
You can look at the file permission settings and see if you or everyone has write permission. You can look explicitly for modes such as 777
, but a better way is to use a bitmask and look specifically at the write permission bits.
The permissions are represented by several bits: the user permissions, group permissions, and finally, the permissions for everyone. The string representation of a 0777
permission would look like this: -rwxrwxrwx
. The bit we are interested in is the one that gives everyone the write permission, which is represented by --------w-
.
The second bit is the only one we care about, so we will use a bitwise AND to mask the file's permission with 0002
. If the bit was set, it will remain the only bit set. If it...