I'm working on a linux privilege escalation. This is the situation: I'm able to write to /bin, and I only have sudo access to run a script. This script just prints information with an echo.
I copied /bin/bash to /bin/echo, hoping that running that sudo script would get me an elevated shell but that didin't work. After replacing /bin/echo, running "echo test" just prints "test". Doing /bin/echo whoever spawns a bash shell.
I checked that my PATH variable is correct (it includes /bin first), and I don't have an "echo" binary in any other path. Running "which echo" returns only "/bin/echo". I tried this in an Ubuntu server, and thought that maybe Apparmor had something to do, but I also tried it on a Debian without Apparmor and didin't work either.
