Skip to main content

100 Reps

Linux Admin: Getting started with File Permissions

Eating Humble Pie

I use Linux every day but not to an advanced System Administrator capacity.

It's easy to "skip through" because I'm familiar with the environment.

Learn about Linux Administration

Resource: Linux Admin for Absolute Beginners

Author: Martin Stevenson

Skill 1: File / Folder Management

Microskill: Read the permission string

Concept: Files and folders have a long permission string.
Each letter has a different meaning

Why it's important: 
Limit the actions of each file on the computer. Read, write, execute.

Where it can go wrong:
  • Read - compromise privacy
    • Example: Employment offer letters, secret keys
  • Write - overwrite/delete important documents
    • Example: Sales scripts, brand images
  • Execute - potential malicious code or accidental running 
    • Example: Malicious file transferred from USB
    • Example: Prevent students from running "update print quota" command

Here is an example:

drwxr-xr-x  3 kali kali 4096 Jul  6 05:02 .
drwxr-xr-x 22 kali kali 4096 Jul  6 04:23 ..
drwxr-xr-x  2 kali kali 4096 Jul  6 04:23 example_folder
-rwxr-xr-x  1 kali kali    0 Jul  6 04:24 sample_program
-rw-r--r--  1 kali kali    0 Jul  6 04:24 sample.txt

  • First character
    • 'd' - directory
    • '-' - plain file
    • 'l' - symbolic link
  • Permission types
    • 'r' - read
    • 'w' - write
    • 'x' - execute
  • Three groups of rwx.
    1. owner
    2. group
    3. world
Read it like this:
  • sample.txt
    • Everyone can read the file
    • only the owner can write to the file
      • The owner is the user "kali"
  • sample_program
    • Everyone can read the file
    • Everyone can execute the file
    • only the owner can write to the file
      • The owner is the user "kali"
Each permission type is given a value:
  • r - 4
  • w - 2
  • x - 1
Total amount is 7 if you add them all up.
Use "chmod" to define the a digit for owner, group, world
Command to give full permissions will be:
chmod 777 filename

Practice this on the sample.txt file:
chmod 777 sample.txt
-rwxrwxrwx 1 kali kali    0 Jul  6 04:24 sample.txt

If you want infinite practice like me, I created a small bash script to create a file and challenge

After doing it 10 times, I'm getting used to setting the numbers for each permission.

What does this mean for cybersecurity?

These permissions are helpful to limit user's ability to interact with files on a Linux machine - like a server.
It doesn't really make too much sense when it's your own personal laptop.
However, when a company's server is online, you don't want everyone who has access to have "God Mode" privileges.
You'll be assigning everyone their own login, permission roles etc.

That being said, if there was a hacker who infiltrated the system, they'll need to escalate their permissions before they can do nasty things on restricted files.
For example, if the account they used didn't have permission to write to a file, they won't be able to directly encrypt it in a ransomware attack.

Cyber Exercise

You are on the Red Team.
The login credentials for the Linux server was the admin's favourite basketball team and his birth year: Cavaliers2001
You've masked your IP address using proxy chaining.

It's time to inject a little script to execute on their computer.

You use scp to send it over using the credentials.
scp payload admin@X.X.X.X:/home/admin

When you send the payload over, it will not be executable by default.
We will need to change the file's permissions.
It's your turn to update it.

Start with using ssh to log in and then use chmod.
Bonus marks if you can keep everything the same and only one execute for the world. (Sneaky sneaky!)
Answer at bottom.

ssh admin@X.X.X.X
chmod 645 payload


At the end of this post, I am able to update the permissions of files and folders given the account I'm using has enough privileges over the file.
As a side benefit, I also got to start writing Bash scripts to automate things - in this case it was to write up a challenge program.

By creating a fake scenario for me to play out, it gives me more reason to understand this concept.

For the readers who tried it out yourself, keep up the good work and keep practicing!


Popular posts from this blog

PicoCTF: Low Level Binary Intro Playlist

Mochi's Tale Mochi's Tale is a really cool little game that teaches you how to "find things out" through experimentation. I found it a really helpful way to get you into the rhythm of learning rules without being told what they are in the first place.

Linux Admin: Managing Users

I read through Chapter 2 of Linux Admin for Absolute Beginners by Martin Stevenson Key Learnings: Add Users Passwords User groups How to add users The flags of adduser varies across different version of Linux, so consult the man pages for more info. I am practising on Kali Linux, the simplest command is: sudo adduser --comment "Gym Owner Terry Crews" tcrews You will need root access for this. So using the root user or adding sudo will work. Sometimes you'll see another command useradd instead. The recommendation is to always use adduser. adduser is a wrapper for useradd.  adduser is more user friendly and interactive than its back-end useradd . There's no difference in features provided. Why is this important? This is how we can create an account for users to access Linux servers. If you have a new employee at your company or student who enters the university, they'll need access to the shared drive, a private drive for themselves etc. Groups Groups keep users i

PicoCTF: The Debugger

GDB baby step 1  Can you figure out what is in the eax register at the end of the main function?  For Mac, gdb can be installed via homebrew: brew install gdbGDB baby step 2 Learn how to disassemble a program from binary file. Here we can see that in line 15, 0x86342 is copied into eax. The output here seems to reverse the arguments.