One file anyone can rewrite
Searching the whole filesystem for files any user can write should come back empty on a clean machine. Here one file comes back: a configuration file owned by root whose permissions end in write-for-everyone, mode 666. That combination is the dangerous one - a service running as root reads the file, and any account on the machine can change what it reads, which turns an ordinary user into whatever that service does. The directory holding it is unremarkable. The temporary directories are world-writable too, but they carry a sticky bit and display drwxrwxrwt, which means a user can only remove their own files there; that is deliberate and not a finding. The distinction worth learning is sticky shared scratch space versus a writable file something privileged depends on.
One file on this machine can be rewritten by anybody who has an account.
A single stray write bit is easy to miss, and it does not look like a vulnerability.
Search the whole filesystem for files any user can write. Here one comes back.
Its permissions end in write for everyone, and it is owned by root. That combination is what matters: a service running as root reads that file, and any account on the machine can change what it reads.
The directory holding it is normal. The temporary directory is world-writable too, but it carries a sticky bit, so you can only remove your own files there.
That is the difference worth learning. World-writable with a sticky bit is ordinary shared scratch space. World-writable on something privileged reads is a way in.
Run the search on your own machine. It should come back empty.
#linux#security#selfhosted#infosec#sysadmin
❯ Run the search on your own machine. It should come back empty.