Feuerfest

The server of a friend got hacked. Vulnerable web application, so the attacker had a local shell as the user the webserver ran under (www-data). Ok, but how did the attacker get root?

Well.. Let's say that this line in /etc/sudoers.d/some-tool didn't help:

www-data ALL=(ALL) NOPASSWD: /usr/bin/apt-get

It was for some self-crafted maintenance tool to allow updating of the package lists via a webinterface. The attacker did run sudo -l listing all sudo rules for www-data and there the line above was found.

All the attacker had to do was:

www-data@host:~$ sudo apt-get update -o APT::Update::Pre-Invoke::=/bin/sh
#

Et voilá one rootshell to go.

Therefore: Always add parameters to your sudo commands! Make them as precise as possible. And if you have a program/binary requiring different parameter combinations: Add them multiple times.

As this would have prevented it:

www-data ALL=(ALL) NOPASSWD: /usr/bin/apt-get update

For the sake of completeness of this demonstration we assigned www-data a password. Normally www-data has no password and hence it would stop there.

www-data@host:~$ sudo apt-get update -o APT::Update::Pre-Invoke::=/bin/sh
[sudo] password for www-data:
Sorry, user www-data is not allowed to execute '/usr/bin/apt-get update -o APT::Update::Pre-Invoke::=/bin/sh' as root on host.