nmap privilege escalation - is still a risk?

Question

There is a known and popular technique to leverage nmap for privilege escalation if the suid bit is set for nmap.

One can execute nmap in interactive mode and from there execute bash commands in the context of root.

nmap can be started in interactive mode as shown below:

nmap --interactive

However, in more recent versions of nmap, the interactive option is not available.

So, is it still possible to access the shell through nmap and execute shell commands in the context of root if the suid bit is set?

I came across this post: https://seclists.org/nmap-dev/2010/q1/1241

It states when the "--interactive" option for nmap was removed.

Note, even in the most recent version of nmap, it displays a warning message when its started and if the suid bit is set:

$ nmap -v

Starting Nmap 7.01 ( https://nmap.org ) at 2019-04-25 06:04 UTC
WARNING: Running Nmap setuid, as you are doing, is a major security risk.

Answer 1

Yes.

As the warning says, it's just not made to be used like that.

Note that there are many potential ways for nmap to make it do something other than network operations. From a quick glance at man page, these could do just that:

• --script, which uses Lua scripts
• -oN <file>, output to file (so you can overwrite something with root)