0

This is more of a curiousity, trying to learn more about linux permissions. So I don't understand why I am able to sudo certain commands and not be prompted for a password but not others. I know that /usr/bin/sudo has a SUID bit which obviously makes sense. I am trying to escalate privelges to root and was wondering if I would be able use /usr/bin/sudo in any way. (This is on an authorized machine don't worry)

Here I show that I am in fact david

david@traverxec:~/bin$ id
uid=1000(david) gid=1000(david) groups=1000(david),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),109(netdev)

Shows the SUID bit set for /usr/bin/sudo and the permissions on the two binaries in question

david@traverxec:~/bin$ ls -la /usr/bin/sudo
-rwsr-xr-x 1 root root 157192 Oct 12 09:49 /usr/bin/sudo

david@traverxec:~/bin$ ls -la /usr/bin/ls
-rwxr-xr-x 1 root root 138856 Feb 28  2019 /usr/bin/ls

david@traverxec:~/bin$ ls -la /usr/bin/journalctl 
-rwxr-xr-x 1 root root 67672 Aug 20  2019 /usr/bin/journalctl

Below Shows that this specific command using sudo to check logs of the webserver works perfectly and doesn't prompt me for a password!

david@traverxec:~/bin$ /usr/bin/sudo /usr/bin/journalctl -n5 -unostromo.service | /usr/bin/cat 
-- Logs begin at Mon 2020-03-02 12:00:21 EST, end at Mon 2020-03-02 12:11:05 EST. --
Mar 02 12:00:44 traverxec su[22169]: pam_unix(su:auth): authentication failure; logname= uid=33 euid=0 tty=pts/0 ruser=www-data rhost=  user=david
Mar 02 12:00:46 traverxec su[22169]: FAILED SU (to david) www-data on pts/0
Mar 02 12:07:26 traverxec nhttpd[23957]: /../../../../bin/sh sent a bad cgi header
Mar 02 12:07:38 traverxec nhttpd[24009]: /../../../../bin/sh sent a bad cgi header

When i try and run any other command using sudo I am prompted for a password

david@traverxec:~/bin$ /usr/bin/sudo /usr/bin/ls /etc/shadow
[sudo] password for david: 

Why is this?

  • 3
    sudo can be made to allow the execution of certain commands without having the give a password, either for all or for certain users or groups of users. This is done in the sudoers configuration file. – Kusalananda Mar 2 at 17:34
  • @Kusalananda Since I do not have read permissions on /etc/sudoers how else could I test to see what commands I have access to? Also I do not have the password for david since I am using SSH keys. – DL_Engineer Mar 2 at 17:47
  • 1
    You may want to contact the administrator(s) of the system about that. – Kusalananda Mar 2 at 18:00
  • 3
    The output of sudo -l might help illustrate the commands/flags that were granted. – Jeff Schaller Mar 2 at 18:24
  • "sudo cat /etc/sudoers" should be illuminating – stolenmoment Mar 2 at 23:56
1

As Kusalananda♦ already mentioned, you configure sudo through the configuration file where you can archive the behavior you describe.

A user can invoke a specific command without the condition of giving a password. This does not mean you have full sudo access. You only have the permission to run a single command.

Sample configuration for that:

david ALL=(ALL) NOPASSWD: /usr/bin/journalctl 

(more at https://askubuntu.com/questions/147241/execute-sudo-without-password)

  • Even if you have a password for user "david" this does not automatically mean you can do anything more with sudo.
  • There is no command for listing permissions which you got through sudo (without having access to /etc/sudoers). Its reasoned through how sudo works. Sudo just checks the configuration at the moment where you invoke a command with it - and this process needs superuser privileges. So there can't be an unprivileged tool which list the settings.

Personal advice: Try other methods for privilege escalations. Sudo is reasonable secure if the configuration is right.

| improve this answer | |
  • Thank you so much! Very clear explination. Yea going to try other methods, kinda figured sudo would be a dead end but I didn't like not understanding why it wasn't working. --cheers – DL_Engineer Mar 2 at 19:57
0

sudo will remember that you have entered a password, and not prompt again for a while (this depends on the configuration).

The /etc/sudoers file has the configuration for sudo. You can set configure:

  • which users
  • which commands
  • whether a password is needed.

It may be that it is set so that you can run some commands with no password.

All this has nothing to do with set-uid bit. This bit as you seem to know gives the program root privileges (see also capabilities: root is dead, long live capabilities). One sudo can do anything, it decides what to do based on its code, and the config file.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.