Exploiting Sudo
exploiting sudo misconfigurations for privilege escalation
The sudo command, by default, allows you to run a program with root privileges by default, or, security privileges of other uses.
The users generally need to have a password to use sudo and must be permitted via access rules in /etc/sudoers
file.
Rules can be used to limit users to certain programs and forgo the password entry requirement.
Run a program as root:
Run a program as a specific user:
List all programs a user is allowed (or disallowed) to run:
Known password
Use any of the following if the low privileged user can run sudo or knows the password.
Shell escape sequences
Some initial programs run with root privileges and any shell spawned by them also runs as root. This is known as a shell escape sequence privilege escalation.
1. Find all programs using the following
2. Head to GTFObins https://gtfobins.github.io/, search for the program name and use the sudo category to find the further steps on to perform the privilege escalation.
Some typical shell escape commands are:
Abusing intended functionality
Certain progams like apache2
can be used to read the first lines of files like /etc/shadow
to read root user's password hash which can be cracked using john or hashcat.
Environment Variables
Programs running through sudo can inherit environment variables from users environment. In the /etc/sudoers
file, if the env_reset
option is set, sudo runs program in a new minimal environment.
The env_keep
option can be used to keep certain environment variables from user's environment.
Linux checks for its required libraries in a number of locations in a specific order:
Directories listed in the application’s RPATH value.
Directories specified in the LD_LIBRARY_PATH environment variable.
Directories listed in the application’s RUNPATH value.
Directories specified in /etc/ld.so.conf.
System library directories: /lib, /lib64, /usr/lib, /usr/lib64, /usr/local/lib, /usr/local/lib64, and potentially others.
LD_PRELOAD (Shared Object Injection)
The LD_PRELOAD environment variable is used to load a shared object before any others when a program is run.
LD_PRELOAD specifies a library which will be loaded prior to any other library when the program gets executed.
1. Figure out if LD_PRELOAD environment option is available
The output should be like:
2. The following code can be used to abuse the LD_PRELOAD (saved as preload.c)
3. Compile as shored object
4. Start up the program with LD_PRELOAD
Run one of the programs you are allowed to run via sudo (listed when running sudo -l), while setting the LD_PRELOAD environment variable to the full path of the new shared object:
This will result in a shell spawn with root privileges.
LD_LIBRARY_PATH (Shared Object Hijacking)
LD_LIBRARY_PATH provides a list of directories where shared libraries are searched for first.
1. Find the list of directories used by the process
2. Create the following code and save it (hijack.c)
3. Compile as shared object by selecting any one name from the output of the ldd
comand. Here we will show the suage of one of the apache2
shared objects.
ldd
comand. Here we will show the suage of one of the apache2
shared objects.4. Start up the program with LD_LIBRARY_PATH
A root shell should open.
Last updated