Let's suppose a scenario of a Unix-like system (like macOs, linux, solaris etc.) having installed a program from the internet that's been developed by a malicious actor.

The program does not use any zero day exploits on the system to escalate privileges. It simply runs within the context of a regular non-administrative user, with all its restrictions. It records all keypresses in the background until it records the user typing into a terminal "su" followed by a password. This program, suddenly, captures the password of the root user.

My question is, having this password captured, can the program relaunch itself from the context of the root user or even escalate its privileges while still running, doing all this without the current user noticing? What utilities do exist that will allow such a program to do such a thing? I'm talking about an ideal scenario in which no bugs or exploits in the kernel are used whatsoever. I'm simply talking about a program simply using existing system utilities in ways that they were already intended to be used.

  • it could just replay the actions it has recorded (ie. open a pseudo-tty, run su inside it, enter the password it has captured, bingo!). As to the user noticing anything, they should've already noticed that someone was recording their movements, right? – mosvy Dec 24 '18 at 18:56

Yes. By execing su. su is a program to allow the change of user with a password. su has the capability of changing user, and will do it only if you provide the correct password.

However the only way to do this is to start a new process, or replace the program of the existing process. It could then re-launch it self with the new privileges.

Pedantic note: A process can escalate its privileges via su. But a program can not. However the new program (su), can relaunch the old one.


This is exactly the sort of situation the expect program (and similar) is designed for. You can run su under expect, detect the password prompt, send the password (that you've captured) and then have a root shell that you can send commands to.


#!/usr/bin/expect --

set mypasswd "imnottellingyou"

spawn "su"
expect "ssword"
send "$mypasswd\n"
expect "#"
  • I would have chosen this answer if the "expect" program came out of the box with my linux system. Still, it's very good and I upvoted it (although this won't show since my reputation is under 15 apparently, sorry). Still, very informative. Thanks! – Alex Dec 25 '18 at 19:56
  • @Alex Yeah, expect is just a simple solution; most distro's have it in their repositories (eg yum install or apt-get install). But a clever person could write their own equivalent using perl or python or C or... – Stephen Harris Dec 26 '18 at 2:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.