5

I've recently read here an answer from a user about the way he hacked a server in a CTF contest. At some point in the description, he said that he did sudo vim and then spawned a shell via VIM using the password he captured before (i'm supposing he did :!bash in vim).

I'm a bit confused why he used this specific vector to spawn a shell... He could had simply executed a sudo bash. Why using Vim to do this?

2 Answers 2

9

One possibility is that sudo was configured to only execute certain applications - you can find examples of this in the sudo manual.

If one of these was vim, but bash was not an option then the user could not run sudo -i or sudo bash but would be able to run sudo vim. However, once done, vim would have an effective uid/gid of 0/0 and quite happily let you run a root bash shell.

This means, as you would expect, that you can actually edit the sudoers file to remove that restriction.

Of course, another thing to note about this trick is the lack of logging. Sudo has run vim, and it will log that fact, but it will not log whatever processes vim chooses to spawn after that! So even if you're not restricted in running the shell, this is a way to disguise what you are doing.

3
  • I see... but doing "sudo bash" and then execute other commands would also create a single log, right?
    – Tiago
    Apr 12, 2013 at 11:36
  • 1
    @Tiago yep, but you'd know that's what they'd done. Assuming you'd chosen to let them edit things, you'd see sudo vim /path/to/file and not think anything of it, because you explicitly let the user do that - but in fact they could have run anything subsequently! Whereas, if you see sudo bash you know they could be running anything subsequently, and, moreover, you likely have logging of shell commands entered (bash .history, for example).
    – user2213
    Apr 12, 2013 at 11:38
  • 1
    Now that you mention it, this was probably the reason for it... not having history recorded. I've tested this and the commands executed in the bash session invoked in VIM do not stay recorded in the history. Great trick indeed :)
    – Tiago
    Apr 14, 2013 at 13:28
3

You can limit the commands a sudo user can execute in the sudoers file, opening a shell through vim would be one way to circumvent that. VIM is not often restricted because file and directory permissions limit the damage you could do with it, so it is an ideal choice for running an illicit shell.

1
  • yes, i understand that. I just don't see this happening very often. Thanks for the info.
    – Tiago
    Apr 14, 2013 at 13:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .