0

Can we write a command to Parse the list of executables listed within the sudoers file and review for world writeable permissions of both the executables and their parent's directories?

I am able to get the list of executables, can anyone help me further to find the permissions of executables and their parent directory.

# for i in `cat /etc/passwd | cut -d: -f1`; do for j in `sudo -lU $i | grep '(root)' | awk '{print $3}'`; do if [ -e $j ]; then echo $j; fi; done; done
/usr/bin/tail
/usr/bin/tail
/usr/bin/tail
/usr/bin/php
/usr/local/nagiosxi/scripts/components/getprofile.sh
/usr/local/nagiosxi/scripts/repair_databases.sh
/usr/local/nagiosxi/scripts/manage_services.sh
/etc/init.d/npcd
/etc/init.d/npcd
/etc/init.d/npcd
/etc/init.d/npcd
/etc/init.d/npcd
/usr/bin/php
/usr/local/nagiosxi/scripts/components/getprofile.sh
/usr/local/nagiosxi/scripts/upgrade_to_latest.sh
/usr/local/nagiosxi/scripts/change_timezone.sh
/usr/local/nagiosxi/scripts/manage_services.sh
/usr/local/nagiosxi/scripts/reset_config_perms.sh
/usr/local/nagiosxi/scripts/manage_ssl_config.sh
/usr/local/nagiosxi/scripts/backup_xi.sh
3
  • What do you want to do about those shell scripts, e.g. if backup_xi.sh wants to execute something out of /tmp? Your next steps are to take each string and progressively remove everything from the last slash onwards. Take this data and remove duplicates, probably add "/" as well. One way of getting permissions in a simple 1 line per entry way is to feed this to xargs ls -ld. You can find world writeable files/directories by using grep for '^........[^-]' and similarly for group writeable. Standard arguments about not parsing the output of ls don't apply, you are creating the data.
    – icarus
    Nov 6 '19 at 17:57
  • Having a scripting language like php included in the sudoers file basically opens up your system to anything the allowed users want to do. For example, having a php script that runs system("/usr/bin/passwd)" is an obvious hack. With this in place, I would not worry about people replacing other allowed programs.
    – doneal24
    Nov 7 '19 at 1:12
  • we are going to write a detection where we can tell the customer what all applications have root access in the sudoers file and if those application and there root directory is having world writable permissions.
    – Arun
    Nov 7 '19 at 8:11
0

First of all I'd like to note that your script didn't work on my machine, however I used the output of it to test my scripts since you say it is working on your machine.

To list the permissions of each file pipe the output as such

| xargs ls -l

and to list the permissions of the directories add this pipe (not after the previous one, but onto your loop)

| sed 's|\(.*\)/.*|\1|' | xargs ls -ld

A lazy way to do it would be to output the result of your script to a temporary file and then use cat to read it (I wrote it all in one line since that's how you provided it in your question

`for i in `cat /etc/passwd | cut -d: -f1`; do for j in `sudo -lU $i | grep '(root)' | awk '{print $3}'`; do if [ -e $j ]; then echo $j; fi; done; done` > /tmp/suexecs && echo `cat /tmp/suexecs | xargs ls -l` && echo `cat /tmp/suexecs | sed 's|\(.*\)/.*|\1|' | xargs ls -ld ` && rm /tmp/suexecs -f

as a shell script:

#!/bin/sh
for i in `cat /etc/passwd | cut -d: -f1`; do
    for j in `sudo -lU $i | grep '(root)' | awk '{print $3}'`; do
         if [ -e $j ]; then echo $j; fi; 
    done 
done > /tmp/suexecs
echo `cat /tmp/suexecs | xargs ls -l`
echo `cat /tmp/suexecs | sed 's|\(.*\)/.*|\1|' | xargs ls -ld`
rm /tmp/suexecs -f
3
  • Yes icarus, my command is not working on other machines I checked, also it does not worked for MAC OSX. Thanks for your inputs, I will definitely look and test these and let you know.
    – Arun
    Nov 7 '19 at 8:17
  • Can you please provide the command working on your system as well.
    – Arun
    Nov 8 '19 at 10:41
  • @Arun to run it on my system I just copied your output to a file and then used cat to pipe it to my commands to simulate you piping your output
    – depsterr
    Nov 8 '19 at 10:43
0

Showing the application not installed in the system but still user is assigned with root access to them.

    for i in `cat /etc/passwd | cut -d: -f1`; do
        for j in `sudo -lU $i | grep '(root)' | awk '{print $3}'`; do
             if [ ! -e $j ]; then echo $j; fi;
        done
done

Showing the application installed in the system and user is assigned with root access to them

for i in `cat /etc/passwd | cut -d: -f1`; do
    for j in `sudo -lU $i | grep '(root)' | awk '{print $3}'`; do
         if [  -e $j ]; then echo $j; fi;
    done
done

List the permissions of the applications present in the system

for i in `cat /etc/passwd | cut -d: -f1`; do
    for j in `sudo -lU $i | grep '(root)' | awk '{print $3}'`; do
         if [  -e $j ]; then echo $j; fi;
    done
done > /tmp/suexecs
echo `cat /tmp/suexecs | xargs ls -l`
rm /tmp/suexecs -f

List the permissions of the directories of application present in the system

for i in `cat /etc/passwd | cut -d: -f1`; do
    for j in `sudo -lU $i | grep '(root)' | awk '{print $3}'`; do
         if [  -e $j ]; then echo $j; fi;
    done
done > /tmp/suexecs
echo `cat /tmp/suexecs |awk  'BEGIN{OFS=FS="/"};{$NF="";print $0}'| xargs ls -ld`
rm /tmp/suexecs -f

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.