From 65d6e4662aa51be1de5765dbbe9be5ecfd868b1a Mon Sep 17 00:00:00 2001
From: s1d3r <60742242+s1d3r@users.noreply.github.com>
Date: Mon, 13 Apr 2026 03:44:18 +0600
Subject: [PATCH] fix(linpeas): highlight writable shell binaries as 95% PE
 vector on merged-usr systems (#630)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The PATH-derived portion of writeVB uses `sed 's/:/$|^/g'` to turn the
colon-separated PATH into an alternation regex. This produces patterns like
`^/usr/bin$|^/sbin$|^/bin` where every entry except the last gets a trailing
`$` anchor — making it an exact match on the directory name itself rather than
a prefix match on files inside it.

On modern merged-/usr distributions (Debian 10+, Ubuntu 20.04+, Fedora 17+,
Arch) `/bin` is a symlink to `usr/bin`, so `find /` returns `/usr/bin/bash`
rather than `/bin/bash`.  The pattern `^/usr/bin$` does not match
`/usr/bin/bash` (the `$` prevents it), so a writable bash binary falls through
to the lower-severity writeB coloring (plain RED) instead of the 95% PE vector
RED/YELLOW.

Add explicit patterns for the common shell interpreters and env so they are
always flagged as 95% PE vectors regardless of PATH ordering or /usr-merge
layout:

  /bin/bash  /usr/bin/bash
  /bin/sh    /usr/bin/sh
  /bin/dash  /usr/bin/dash
  /bin/zsh   /usr/bin/zsh
  /usr/bin/env

Co-authored-by: s1d3r <s1d3r@users.noreply.github.com>
---
 linPEAS/builder/linpeas_parts/variables/writeVB.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/linPEAS/builder/linpeas_parts/variables/writeVB.sh b/linPEAS/builder/linpeas_parts/variables/writeVB.sh
index d7e41ec..66aa568 100644
--- a/linPEAS/builder/linpeas_parts/variables/writeVB.sh
+++ b/linPEAS/builder/linpeas_parts/variables/writeVB.sh
@@ -13,4 +13,4 @@
 # Small linpeas: 1
 
 
-writeVB="/etc/anacrontab|/etc/apt/apt.conf.d|/etc/bash.bashrc|/etc/bash_completion|/etc/bash_completion.d/|/etc/cron|/etc/environment|/etc/environment.d/|/etc/group|/etc/incron.d/|/etc/init|/etc/ld.so.conf.d/|/etc/ld.so.preload|/etc/master.passwd|/etc/passwd|/etc/profile.d/|/etc/profile|/etc/rc.d|/etc/shadow|/etc/skey/|/etc/sudoers|/etc/sudoers.d/|/etc/supervisor/conf.d/|/etc/supervisor/supervisord.conf|/etc/systemd|/etc/sys|/lib/systemd|/etc/update-motd.d/|/root/.ssh/|/run/systemd|/usr/lib/cron/tabs/|/usr/lib/systemd|/systemd/system|/var/db/yubikey/|/var/spool/anacron|/var/spool/cron/crontabs|"$(echo $PATH 2>/dev/null | sed 's/:\.:/:/g' | sed 's/:\.$//g' | sed 's/^\.://g' | sed 's/:/$|^/g') #Add Path but remove simple dot in PATH
+writeVB="/etc/anacrontab|/etc/apt/apt.conf.d|/etc/bash.bashrc|/etc/bash_completion|/etc/bash_completion.d/|/etc/cron|/etc/environment|/etc/environment.d/|/etc/group|/etc/incron.d/|/etc/init|/etc/ld.so.conf.d/|/etc/ld.so.preload|/etc/master.passwd|/etc/passwd|/etc/profile.d/|/etc/profile|/etc/rc.d|/etc/shadow|/etc/skey/|/etc/sudoers|/etc/sudoers.d/|/etc/supervisor/conf.d/|/etc/supervisor/supervisord.conf|/etc/systemd|/etc/sys|/lib/systemd|/etc/update-motd.d/|/root/.ssh/|/run/systemd|/usr/lib/cron/tabs/|/usr/lib/systemd|/systemd/system|/var/db/yubikey/|/var/spool/anacron|/var/spool/cron/crontabs|/bin/bash|/usr/bin/bash|/bin/sh|/usr/bin/sh|/bin/dash|/usr/bin/dash|/bin/zsh|/usr/bin/zsh|/usr/bin/env|"$(echo $PATH 2>/dev/null | sed 's/:\.:/:/g' | sed 's/:\.$//g' | sed 's/^\.://g' | sed 's/:/$|^/g') #Add Path but remove simple dot in PATH