DΛΣMӨП

// HackTricks · Linux

Sudo Command Abuse

Sudo Command Abuse

Sudo-allowed interpreters

If sudo -l allows a user to run an interpreter as root, treat it as direct code execution. Interpreters are designed to execute arbitrary code, so a rule that allows python3, perl, ruby, lua, node, or similar binaries is usually equivalent to root command execution unless the arguments are tightly constrained and validated.[1][2][3][4][5][7][9][11]

Common review flow: first list the user’s privileges, then execute a Python statement with the interpreter’s -c option.[1][3][4]

sudo -l
sudo /usr/bin/python3 -c 'import os; os.system("id")'
sudo /usr/bin/python3 -c 'import os; os.system("/bin/sh")'

Other interpreter examples are shown below; the listed interpreters document inline-code execution or child-process APIs.[5][6][7][8][9][10][11]

sudo /usr/bin/perl -e 'exec "/bin/sh";'
sudo /usr/bin/ruby -e 'exec "/bin/sh"'
sudo /usr/bin/node -e 'require("child_process").spawn("/bin/sh", {stdio: [0,1,2]})'

The exact path matters. If the sudo rule allows /usr/bin/python3, use that exact path during validation.[2]

sudo /usr/bin/python3 -c 'import os; os.setuid(0); os.setgid(0); os.system("/bin/sh")'

Sudo-allowed editors

If sudo -l allows a user to run an interactive editor as root, treat it as a command-execution surface, not as a harmless file-editing permission. Editors can often execute shell commands, read arbitrary files, write arbitrary files, or invoke external helpers from inside the editor.[1][12][13][14]

Common review flow: list the user’s privileges, then invoke each allowed editor or pager under sudo.[1][12][13][14]

sudo -l
sudo /usr/bin/nano /etc/hosts
sudo /usr/bin/vim /etc/hosts
sudo /usr/bin/less /etc/hosts

Nano command execution

When nano is allowed through sudo, command execution may be reachable from the editor interface.[12]

Ctrl+R
Ctrl+X

Then provide a command such as id or /bin/sh to the nano command prompt.[12]

id
/bin/sh

If an interactive shell does not have usable terminal streams, this redirection form maps its standard output and error to descriptor 0.[15]

reset; /bin/sh 1>&0 2>&0

The exact key sequence can vary with nano version and build options, but the security issue is the same: the editor is running as root and can invoke external commands.[1][12]

Other common editor escapes

Vim-style editors commonly expose command execution through :!.[13]

:!/bin/sh

Pagers such as less can also expose shell execution.[14]

!/bin/sh

Defensive notes

  • Avoid granting interpreters or interactive editors through sudo.[1]
  • Prefer fixed, root-owned wrappers that perform one narrow administrative action.[1][2]
  • If an interpreter is unavoidable, restrict the exact script path and prevent user-controlled arguments, writable imports, PYTHONPATH, and unsafe environment preservation.[2][3][4]
  • If file editing is required, restrict the exact file path and consider sudoedit with patched sudo versions and strict environment handling.[1][2]
  • Review SETENV, env_keep, writable working directories, writable module/import paths, NOEXEC, use_pty, and logging, but do not treat them as a complete sandbox.[1][2][3]

References