2

I'm testing for privilege escalations on a Ubuntu 18.04 host, and after running sudo -l , I've discovered a couple of root NOPASSWD commands for a standard user (w/unknown password). These commands contain wild cards.

Example: (root) NOPASSWD: /usr/bin/ssh * /path/to/bash/script.sh

I've already attempted to inject root commands, without any luck.

Failed Attempt: /usr/bin/ssh user@localhost "cat /etc/shadow" ; /path/to/bash/script.sh

Is it possible to get command injection in such a case, and get commands to run with sudo privileges?

Any advice is appreciated.

2

Well after beating my head against numerous commands, I finally found that I could escape the wild card and cat out /etc/shadow

...With a little help from this cheat sheet

$LFILE=/etc/shadow

Success: sudo /usr/bin/ssh user@localhost -F $LFILE /path/to/bash/script.sh

Hope this helps someone in the future. :) Cheers!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.