Abusing Sudo
On UNIX systems,
the sudo utility can be used to execute a command with elevated privileges.
To be able to use sudo,
our low-privileged user account must be a member of the sudo group
(on Debian based Linux distributions).
The word “sudo” stands for “Superuser-Do”,
and we can think of it as changing the effective userid of the executed command.
Custom configurations of sudo-related permissions
can be applied in the /etc/sudoers file.
We can use the -l or --list option
to list the allowed commands for the current user.
From the output,
we notice that only crontab jobs,
tcpdump,
and apt-get utilities are listed as allowing sudo commands.
If the /etc/sudoers configurations are too permissive,
a user could abuse the short-lived administrative
right to obtain permanent root access.
Since the first of the three permitted commands
does not allow us to edit any crontab,
it’s unlikely that we could use this to find any escalation route.
The second command looks more promising,
so let’s browse GTFObins for suggestions on how to abuse it.
We’ll copy the commands 1for our low privilege shell.
Running the hinted commands, however, reveals an unexpected outcome:
Surprisingly, once we’ve executed the suggested command-set,
we are prompted with a “permission denied” error message.
To further investigate the culprit,
we can inspect the syslog file for any occurrence of the tcpdump keyword.
The output shows
that the audit daemon has logged our privilege escalation attempt.
Closer inspection reveals that AppArmor was triggered and blocked us.
AppArmor is a kernel module
that provides mandatory access control on Linux systems
by running various application-specific profiles,
and it’s enabled by default on Debian 10.
We can verify AppArmor’s status as the root user using the aa-status command.
The output confirms that tcpdump is actively protected
with a dedicated AppArmor profile.
Since the first two commands from the sudoers file did not work,
let’s examine the third allowed sudo command:
apt-get.
Returning again to GTFOBins, we’ll select the first option (a).
The payload first runs the changelog apt-get command option,
invoking the less application from which we can execute a bash shell.
We can try the commands as the joe user by copying them in our active shell.
Excellent!
We managed to obtain a privileged root shell
by abusing a misconfigured sudo configuration.