Sudo Privilege Escalation for Beginners

Hello! Welcome back to our module on Privilege Escalation.

In the last lesson, you learned how to perform systematic enumeration on a compromised Linux host. You used manual commands and powerful automated scripts like LinEnum and LinPEAS to gather information and, most importantly, identify potential privilege escalation vectors. One of the first and most critical checks you learned was running sudo -l to see what commands your current user can execute with higher privileges.

Today, we'll take the next logical step. This lesson will teach you how to exploit misconfigured sudo permissions to escalate your privileges to root. You'll move from finding these weaknesses to actively exploiting them, a core skill for any penetration tester or bug bounty hunter. We will cover the most common exploitation paths, from abusing overly permissive binaries to more advanced techniques involving environment variables.

1. Understanding Sudo and the Sudoers File

On Linux, the sudo command (superuser do) allows a permitted user to execute a command as another user, typically the root user. The rules that govern who can run what are defined in the /etc/sudoers file. A misconfiguration in this file is one of the most common and reliable ways to escalate privileges.

As you learned previously, the command sudo -l is your primary tool for investigating these rules. It lists the allowed and forbidden commands for your current user.

Let's look at what a misconfiguration might look like in the actual sudoers file.

The syntax user host=(runas) options: command is key. The NOPASSWD option is a significant finding because it means you can execute the command as root without needing to know the user's or root's password.

2. Exploiting Sudo-able Binaries with GTFOBins

The most straightforward sudo exploit involves a binary that can, by its nature, interact with the operating system—for example, by opening a shell or reading/writing files. If such a binary is permitted in the sudoers file, you can often leverage its intended functionality to break out and gain a root shell.

Your best friend for this task is GTFOBins. It's a curated list of Unix binaries and how they can be abused to bypass local security restrictions.

Let's see this in action. The following video demonstrates finding and exploiting a sudo rule for Python. This directly continues from the enumeration workflow you studied in the previous lesson.

The pattern you just saw is fundamental:

1. Run sudo -l to find a (root) NOPASSWD: entry for a binary.
2. Search for that binary on GTFOBins.
3. Copy and adapt the command from the "Sudo" section.
4. Execute it to get a root shell.

This works for a huge number of standard Linux commands: find, less, more, nano, vim, awk, nmap, and many more. If you can run it as root, check GTFOBins.

User webadmin may run the following commands on this host:
    (root) NOPASSWD: /usr/bin/less

3. Exploiting Sudo with Environment Variables

A more advanced, and often overlooked, vector involves sudo's handling of environment variables. By default, sudo resets most environment variables for security. However, a misconfiguration can cause it to preserve "unsafe" variables.

The most notorious of these is LD_PRELOAD. This is a Linux environment variable that tells the dynamic linker to load a specified shared library (.so file) before any others. If you can control this variable and execute a program with sudo, you can force that program to load your own malicious library, executing your code with root privileges.

Step 1: Identification

First, you need to check if LD_PRELOAD is preserved. Again, sudo -l is the tool.

Step 2: Exploitation

If you find that LD_PRELOAD is kept, the process is as follows:

1. Write a simple C program that will spawn a root shell.
2. Compile this C code into a shared object (.so) file.
3. Execute any of the allowed sudo commands while setting the LD_PRELOAD variable to point to your malicious shared object.

The following guide provides a clear, practical walkthrough. Given your Computer Science background, you should find the C code and compilation steps straightforward.

This technique is powerful because it works with any program you can run with sudo if LD_PRELOAD is preserved. The program doesn't need to have shell-spawning capabilities itself; your malicious library provides them. A similar technique exists for the LD_LIBRARY_PATH variable, which is also covered in the same article.

4. Other Common Sudo Misconfigurations

While abusing binaries and LD_PRELOAD are the most frequent vectors, it's good to be aware of a few others:

• (ALL : ALL) NOPASSWD: ALL: This is the ultimate jackpot. If you see this in sudo -l, it means your user can run any command as any user without a password. You can simply run sudo su or sudo /bin/bash to become root immediately.
• PATH Hijacking: If a command is listed in sudoers without its full path (e.g., apache2 instead of /usr/sbin/apache2), sudo will search for the binary in the directories specified by the PATH variable. If you have write permissions to a directory that appears earlier in the PATH than the legitimate binary's location, you can create a malicious script with the same name (e.g., a script named apache2 in /tmp), and sudo might execute your script as root instead of the real one.
• Script Exploitation: Sometimes sudo allows a user to run a script (e.g., a Python or Bash script) as root. If you have write permissions to that script, you can simply edit it to include a payload, like a reverse shell, and then run it with sudo to get root.

Conclusion

You have now learned how to turn the output of your enumeration tools into a root shell by exploiting sudo misconfigurations. This is a critical and highly practical skill that moves you from being a passive observer on a system to an active administrator.

Key Takeaways:

• sudo -l is Paramount: Always check your sudo privileges first upon gaining access to a system. Look for NOPASSWD and env_keep directives.
• GTFOBins is the Playbook: For any standard binary you can run as root, GTFOBins provides the exact command to elevate your privileges. This should be a reflex.
• LD_PRELOAD is a Powerful Vector: If sudo preserves the LD_PRELOAD environment variable, you can gain root access by creating a malicious shared object, regardless of what the sudo-ed program is.
• Context is Key: Privilege escalation isn't just one trick. It's about understanding how permissions, binaries, and environment variables interact, and spotting when those interactions are insecure.

Next Lesson Preview:

In our next lesson, we will explore another extremely common Linux privilege escalation vector: Exploiting SUID/GUID binaries. You will find that the methodology is very similar to what you learned today. You'll use enumeration to find these special binaries and then consult resources like GTFOBins to exploit them. This will further reinforce the pattern of "find, research, exploit."