Unit 12: Auditing and hardening · Lesson 1 of 7 · 18 min
sudo rules and SUID files
The two ways a normal user can end up running code as root.
mission
- You are
- You are running the privilege part of the web01 audit.
- Situation
- The handover says the sudo rules need tidying and an old backup helper still sits in /usr/local/bin.
- Goal
- Review your own sudo rights and every SUID program.
- Hand in
- Two findings with evidence.
Read your sudo rule
Ask of every allowed program: can it start other programs? Editors, pagers, interpreters and some search tools can.
sudo -l | tail -n 2 User learner may run the following commands on root-lab: (root) NOEXEC: NOPASSWD: /usr/bin/ss, /usr/bin/find, /usr/bin/tail /var/log/auth.log sudo find /tmp -maxdepth 0 -exec id \; find: ‘id’: Permission denied
you should see find can run a command for each file. NOEXEC blocks that here, which is a safety net, not a fix.
defender tip The fix is to remove find from the rule. If someone needs to search as root, give them a specific script instead.
Use the rule as intended
sudo find /usr/local -perm -4000 -type f
/usr/local/bin/backup-helper
you should see Running as root, find sees everything. Here it confirms the only hand-added SUID program.
Ask the package manager
stat -c '%A %U %n' /usr/local/bin/backup-helper -rwsr-xr-x root /usr/local/bin/backup-helper dpkg -S /usr/local/bin/backup-helper dpkg-query: no path found matching pattern /usr/local/bin/backup-helper
you should see SUID root and owned by no package. It is a copy of cat, so anyone can read any file as root.
What a defender takes away
- 1Read every sudo rule and ask what else the program can do.
- 2NOEXEC limits damage but the rule still needs fixing.
- 3Every SUID file needs a package or a written reason.
Questions
0 of 2 solved
Answer each one from what you find on your lab machine.