Context: Debian Linux.
Alice has a user account on the machine. She is one of sudoers and has a secure password. She accesses the machine via SSH using a SSH key only (password will not work).
By some administrative mistake, Bob gets access to the same account instead of getting a separate account: his SSH key is added to
authorized_keys. Bob does not get the password from Alice.
How could Bob successfully perform a sudo? Assume that:
- Bob has no access to the server except for the SSH access to Alice's account.
- Alice will be connecting to her account regularly, performing sudo etc.
I assume this cannot be done without Alice's cooperation. Thus I am looking for some kind of phishing or social engineering attack, like replacing sudo with an alias that will log the password first.
It's basically a traditional root escalation problem with the added benefit of (unaware) user cooperation.