Sudo Privilege Escalation
Sudo commands might be vulnerable to privilege escalation (PrivEsc).
PreviousSudo Path Traversal Privilege EscalationNextSudo Privilege Escalation by Overriding Shared Library
Last updated
Sudo commands might be vulnerable to privilege escalation (PrivEsc).
Last updated
provides a wide variety of payloads to privilege escalation. So it's recommended to look for in there.
If the sudo version <=1.28, try the following command.
We may be able to see the commands available as another user.
Also we might see from following files.
If we find the following result for sudoers,
We might be able to get a root shell as follow.
If we have permission to write /etc/sudoers, we can modify this file.
Now add the following line to allow us to execute all commands as root.
Assume we logged in as john.
If you are allowed to execute some command, you can forge the contents of the command. First off, check the properties.
If you can confirm that it can be executed as root without password, create the same named command in the arbitrary folder in which you can write files.
Next, change the permission for allowing to execute it. And add the path to the environment.
Now execute the command as root.
If you found there is a SETENV: in sudoers, you can set the PATH when running the command.
As the previous section, prepare the payload.
Now run the command as root with setting the PATH.
If we can execute some command as root but env_reset and secure_path are set, we cannot override the PATH environment variable.
Instead we need to check if we have permission to write each path.
Assume we can write an arbitrary binary file under /usr/sbin, we can create a payload in there.
For example, we create a python binary under /usr/sbin.
Then execute the sudo command.
Now we should get a root shell.
If we found there is another user’s script which can be executed as root, you can input `/bin/bash -i` to get a shell as another user.
If the current user executes some command using sudo, we might be able to escalate to root privilege. Check if no restriction on ptrace.
If the target system does not have gdb binary, we can download it.
After that, we can spawn the root shell.
Reference:
Next, prepare the exploit script from and execute it.
