I have access to a server via RCE over http. I can send post requests to the server which results in command execution. I am attempting to escalate privileges via sudo (su is not installed).
The server is heavily firewalled with egress filters and there are no writeable directories/files within the web application.
My objective is to experiment with the
sudo command to escalate privileges but because the command execution is not TTY; I am unable to execute the sudo command.
Is it possible to execute a command like
sudo -S in a non-TTY shell?
Maybe using python's pty module to spawn
/bin/sh, but what about a method to just execute a single binary with some parameters passed to it like
sudo -S <command> within/as a TTY shell?
To summarize: Is there a way to run
sudo in a single line in a non-TTY shell?
For example I am trying to run sudo with these parameters:
echo <password> | sudo -u root -S id
When I execute the above command I receive the following output:
sudo: sorry, you must have a tty to run sudo