0

Hi all I'm moderately new to Linux so hoping I can get some help.. I am currently running Kali Linux and trying to practice privilege escalation using sudo -l. As background, I currently am accessing a system as user1 but do not have access to their password. When running sudo -l i'm getting the following results:

sudo -l
Matching Defaults entries for user1 on thisdevice:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User user1 may run the following commands on thisdevice:
    (user2) NOPASSWD: /usr/bin/vi /home/user2/details.txt

to my knowledge, it means that I as user1 should be able to use sudo vi command to access the details.txt file in the user2 directory? however when attempting to perform sudo vi, I am still being asked to provide password for user1.

Does anyone know by any chance if I am making a mistake or potentially some help? I have been on GTFOBINS (a curated list of Unix binaries that can be exploited by an attacker to bypass local security restrictions) looking at vi but can't seem to progress after this part.

0

1 Answer 1

3

The sudo command provides intentional privilege escalation - that's exactly why it exists.

The sudoers definition you have shown is very specific: it allows you to use /usr/bin/vi to edit the precise file path /home/user2/details.txt. This command would work

sudo -u user2 vi /home/user2/details.txt

But this one would not

cd /home/user2
sudo -u user2 vi details.txt

I've seen that you mention sudo vi. You do not have permissions to do that, as the implied target user for sudo is root unless otherwise specified with the -u option.

Note that there is a trivial break from sudo [options] vi ... in that vi's :shell command will execute an interactive shell as the target user.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.