There is a known and popular technique to leverage nmap for privilege escalation if the suid bit is set for nmap.

One can execute nmap in interactive mode and from there execute bash commands in the context of root.

nmap can be started in interactive mode as shown below:

nmap --interactive

However, in more recent versions of nmap, the interactive option is not available.

So, is it still possible to access the shell through nmap and execute shell commands in the context of root if the suid bit is set?

I came across this post: https://seclists.org/nmap-dev/2010/q1/1241

It states when the "--interactive" option for nmap was removed.

Note, even in the most recent version of nmap, it displays a warning message when its started and if the suid bit is set:

$ nmap -v

Starting Nmap 7.01 ( https://nmap.org ) at 2019-04-25 06:04 UTC
WARNING: Running Nmap setuid, as you are doing, is a major security risk.


As the warning says, it's just not made to be used like that.

Note that there are many potential ways for nmap to make it do something other than network operations. From a quick glance at man page, these could do just that:

  • --script, which uses Lua scripts
  • -oN <file>, output to file (so you can overwrite something with root)
| improve this answer | |
  • Yes, I can use a Lua script on my system to leverage the scripting engine of nmap and invoke a system command using: os.system(). On my local machine, I am able to execute the commands and view files which can only be viewed by the root user. However, on another system, I get a permission denied error. Even though on both the systems, the suid bit is enabled for nmap and the same NSE scripts are used as well. – Neon Flash Apr 25 '19 at 11:38
  • 1
    @NeonFlash who is the owner of the file? Setuid changes EUID to the owner of the file, which is usually root, but not always. – bonsaiviking Apr 25 '19 at 17:01
  • @bonsaiviking Both the owner and group for /usr/bin/nmap show as root for the machine and even then I'm not able to execute commands under context of root. However, the exact same works on my local machine. – Neon Flash Apr 27 '19 at 15:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.