Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I've recently read here an answer from a user about the way he hacked a server in a CTF contest. At some point in the description, he said that he did sudo vim and then spawned a shell via VIM using the password he captured before (i'm supposing he did :!bash in vim).
I'm a bit confused why he used this specific vector to spawn a shell... He could had simply executed a sudo bash.
Why using Vim to do this?
One possibility is that sudo was configured to only execute certain applications - you can find examples of this in the sudo manual.
If one of these was vim, but bash was not an option then the user could not run sudo -i or sudo bash but would be able to run sudo vim. However, once done, vim would have an effective uid/gid of 0/0 and quite happily let you run a root bash shell.
This means, as you would expect, that you can actually edit the sudoers file to remove that restriction.
Of course, another thing to note about this trick is the lack of logging. Sudo has run vim, and it will log that fact, but it will not log whatever processes vim chooses to spawn after that! So even if you're not restricted in running the shell, this is a way to disguise what you are doing.
sudo vim /path/to/file and not think anything of it, because you explicitly let the user do that - but in fact they could have run anything subsequently! Whereas, if you see sudo bash you know they could be running anything subsequently, and, moreover, you likely have logging of shell commands entered (bash .history, for example).
You can limit the commands a sudo user can execute in the sudoers file, opening a shell through vim would be one way to circumvent that. VIM is not often restricted because file and directory permissions limit the damage you could do with it, so it is an ideal choice for running an illicit shell.
