Unit 12: Auditing and hardening · Lesson 2 of 7 · 12 min

World-writable files

A file anyone can change is a file anyone controls.

mission

You are: You are sweeping for files everyone can write.
Situation: Shared folders like /tmp are writable by design. Scripts and configs never should be.
Goal: List every world-writable file and folder and sort normal from dangerous.
Hand in: The one file that must be fixed.

Good and bad

Sticky folders/tmp, /var/tmp: normal
Writable scriptsAnyone controls what runs
Writable configsAnyone changes behaviour

Folders first

learner@root-lab

learner@root-lab:~$ find / -xdev -type d -perm -0002 2>/dev/null
/tmp
/var/tmp
/run/lock

you should see All three carry the sticky bit, so people can only delete their own files. Normal.

Then files

learner@root-lab

learner@root-lab:~$ find / -xdev -type f -perm -0002 2>/dev/null
/opt/scripts/rotate.sh
learner@root-lab:~$ stat -c '%a %A %n' /opt/scripts/rotate.sh
777 -rwxrwxrwx /opt/scripts/rotate.sh

you should see The script cron runs as root every hour. Your top finding.

Fixes for the ticket

Command	What it does
`chmod o-w file`	Remove write for others
`chmod 755 script`	Owner writes, everyone runs
`chmod u-s file`	Remove SUID

Files that belong to nobody

Files whose owner account was deleted can be claimed by a new account with the same UID.

learner@root-lab

learner@root-lab:~$ find / -xdev -nouser 2>/dev/null | head -n 3
learner@root-lab:~$ find /etc /opt /usr/local -perm -o+w ! -type l 2>/dev/null
/opt/scripts/rotate.sh

you should see No orphaned files, and rotate.sh again in the narrower search.

What a defender takes away

1find -perm -0002 lists world-writable entries.
2Sticky folders are normal, writable scripts are not.
3Writable plus run by root is the worst combination.

Questions

0 of 1 solved

Answer each one from what you find on your lab machine.

1Which file on the main disk can anyone write to?
Show hint
find / -xdev -type f -perm -0002