Prevent a remote privilege escalation when the root/admin password is known

Question

Consider the following Linux system:

• root account is disabled (passwd -l root, passwd -d root),
• there is an account 'admin', with sudo rights,
• there is an account 'webservice', with limited privileges, and no sudo rights,
• su is disabled via PAM (auth required pam_wheel.so),
• only 'admin' can SSH into the system (AllowUsers directive, only with a key, no password accepted),
• 'webservice' runs some web services which has been compromised: an attacker can now run remotely any shell command as the user 'webservice',
• the attacker has no physical access to the device,
• finally, the attacker knows the 'admin' password, but not admin's SSH key

How could the attacker run a command as 'admin'?

My understanding is that the attacker cannot sudo, cannot su, cannot SSH, even if the admin password is known, so no privilege escalation is possible. Is that correct? My objective is to understand the consequences and the possible mitigation (if any) of having an admin password compromised.

Answer 1

You should make sure that no other service allow login with username and password. Some systems have an active telnetd or ftpd by default. Ftp would be enough because it would allow to overwrite admin's authorized_keys file.

You should also control that exec login is not possible in your system from a simple shell.

Finally you should control that webservice is not allowed to write files in any directory where admin or root could try to execute files (the dangerous . in PATH for example).

Those are just the first possible vulnerabilities I could think of. Do not hope that list to be exhaustive...