Sudo misconfiguration: from user to root

October 16, 2024 · 1 min read · #linux #privilege-escalation #sudo

sudo lets a user run commands as root. Misconfigurations turn it into a ladder.

The typical cases

Binary with a shell escape: if you can run as root a program that spawns commands (vim, less, find, awk), you get a root shell. GTFOBins catalogs these escapes.

sudo find . -exec /bin/sh \; -quit   # root shell
sudo vim -c ':!/bin/sh'

NOPASSWD on too much, env_keep preserving LD_PRELOAD, or exploitable wildcards are other routes.

Defence

Least privilege in sudoers: specific commands with absolute paths, no binaries with escapes, no wildcards. Remove dangerous env_keep. Check with sudo -l what is granted and compare with GTFOBins. Periodic audit of /etc/sudoers and sudoers.d.

« back to home