> For the complete documentation index, see [llms.txt](https://oscp.adot8.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://oscp.adot8.com/linux-privilege-escalation/misc/abusing-scripts.md).

# Abusing scripts

## Command Injection w/ Scripts

<figure><img src="https://3007503158-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fp6nDpW0GBTPP8pZM4JHQ%2Fuploads%2FfhiYjqHWUJkUWzpxqUIC%2Fimage.png?alt=media&amp;token=256033dc-45f4-446b-87cd-f8307ac2b0d4" alt=""><figcaption></figcaption></figure>

This bit of code on in a script (being ran as root) isn't using the full path of another script when calling upon it. We can simply place a script in the pwd to run instead of it

{% hint style="info" %}
If source code is being handed to you, READ IT
{% endhint %}

<figure><img src="https://3007503158-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fp6nDpW0GBTPP8pZM4JHQ%2Fuploads%2FD96rfiPIyfZT7bmi8yYj%2Fimage.png?alt=media&amp;token=25a057a8-9a78-4243-92d8-6df4c7e2cd8f" alt=""><figcaption></figcaption></figure>

This is python2 because there are no () on the print. Code execution is possible with the **input** function in python2

```
__import__('os').system('/bin/bash')
```