Privilege Escalation · Term

What is sudo abuse?

sudo lets chosen users run specific commands as root, but a too-broad or careless rule can hand any of those users a full root shell. Here is what sudo abuse is, the common misconfigurations, and how to find them.

Privilege Escalation · TermAll services
TL;DR

Sudo abuse is privilege escalation through misconfigured `sudo` rules. The sudoers policy decides which users can run which commands as root. When a rule is too broad (allowing a program that can spawn a shell), uses NOPASSWD, or keeps a dangerous environment variable like LD_PRELOAD, a low-privileged user can turn their allowed command into a root shell. The first thing an attacker runs is sudo -l, and GTFOBins maps which sudo-allowed binaries escalate.

By John Dill, Red Team Lead, SecureLayer7Updated

What sudo abuse is

sudo lets administrators grant specific users the right to run specific commands as another user, usually root, defined in the sudoers file. Used carefully it is least-privilege done well.

The abuse comes from over-broad or careless rules: allowing a program that can launch a shell or read/write any file, allowing all commands, using NOPASSWD so no password is needed, or preserving dangerous environment variables. Each turns a narrow grant into full root.

The common misconfigurations and payload

The attacker starts with sudo -l to see what they are allowed, then exploits it:

  • A sudo-allowed editor or pager: sudo vim -c ':!/bin/sh' or sudo less /etc/profile then !sh
  • Any sudo-allowed binary on GTFOBins (find, awk, python, tar with checkpoint, etc.)
  • LD_PRELOAD kept via env_keep: compile a small library that calls setuid(0), then sudo LD_PRELOAD=/tmp/x.so <allowed-cmd>
  • A rule allowing ALL commands is an immediate sudo /bin/bash.

Documented techniques shown for defenders.

How to defend

  • Grant the minimum: only the exact commands a user needs, never ALL, and avoid programs that can spawn shells or read arbitrary files.
  • Avoid NOPASSWD except where truly necessary.
  • Do not keep dangerous environment variables (remove env_keep entries like LD_PRELOAD; keep env_reset on).
  • Use full paths in sudoers and avoid wildcards.
  • Review sudoers regularly and test rules against GTFOBins-style abuse.

References

  1. [1]Linux man-pages: sudoers(5)(man7.org)
  2. [2]MITRE ATT&CK: Privilege Escalation (TA0004)(MITRE)
  3. [3]NIST SP 800-115 Technical Guide to Security Testing(NIST)
Related terms

Common questions

Privilege escalation, asked often

Want your systems tested for these paths?

Scope an engagement

Find the privilege-escalation paths before an attacker does.

We run internal and host penetration tests that walk the real route from a low-privileged foothold to root or SYSTEM, then hand your team a report with reproducible evidence and a fix for every step. Free re-test included.

See all services30-min scoping call, fixed-price proposal in 48 hours.