Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've recently read here an answer from a user about the way he hacked a server in a CTF contest. At some point in the description, he said that he did sudo vim and then spawned a shell via VIM using the password he captured before (i'm supposing he did :!bash in vim).

I'm a bit confused why he used this specific vector to spawn a shell... He could had simply executed a sudo bash. Why using Vim to do this?

share|improve this question

2 Answers 2

up vote 9 down vote accepted

One possibility is that sudo was configured to only execute certain applications - you can find examples of this in the sudo manual.

If one of these was vim, but bash was not an option then the user could not run sudo -i or sudo bash but would be able to run sudo vim. However, once done, vim would have an effective uid/gid of 0/0 and quite happily let you run a root bash shell.

This means, as you would expect, that you can actually edit the sudoers file to remove that restriction.

Of course, another thing to note about this trick is the lack of logging. Sudo has run vim, and it will log that fact, but it will not log whatever processes vim chooses to spawn after that! So even if you're not restricted in running the shell, this is a way to disguise what you are doing.

share|improve this answer
    
I see... but doing "sudo bash" and then execute other commands would also create a single log, right? –  Tiago Apr 12 '13 at 11:36
1  
@Tiago yep, but you'd know that's what they'd done. Assuming you'd chosen to let them edit things, you'd see sudo vim /path/to/file and not think anything of it, because you explicitly let the user do that - but in fact they could have run anything subsequently! Whereas, if you see sudo bash you know they could be running anything subsequently, and, moreover, you likely have logging of shell commands entered (bash .history, for example). –  user2213 Apr 12 '13 at 11:38
    
Great, thanks for the explanation –  Tiago Apr 14 '13 at 13:17
1  
Now that you mention it, this was probably the reason for it... not having history recorded. I've tested this and the commands executed in the bash session invoked in VIM do not stay recorded in the history. Great trick indeed :) –  Tiago Apr 14 '13 at 13:28

You can limit the commands a sudo user can execute in the sudoers file, opening a shell through vim would be one way to circumvent that. VIM is not often restricted because file and directory permissions limit the damage you could do with it, so it is an ideal choice for running an illicit shell.

share|improve this answer
    
yes, i understand that. I just don't see this happening very often. Thanks for the info. –  Tiago Apr 14 '13 at 13:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.