I'm testing for privilege escalations on a Ubuntu 18.04 host, and after running sudo -l , I've discovered a couple of root NOPASSWD commands for a standard user (w/unknown password). These commands contain wild cards.
(root) NOPASSWD: /usr/bin/ssh * /path/to/bash/script.sh
I've already attempted to inject root commands, without any luck.
/usr/bin/ssh user@localhost "cat /etc/shadow" ; /path/to/bash/script.sh
Is it possible to get command injection in such a case, and get commands to run with sudo privileges?
Any advice is appreciated.