← Back to Academy

Academy Node

Linux Sudo Abuse

Sudo abuse occurs when a user can run commands as another user or root in a way that can be escaped or abused.

Intermediate100 XPLinux PrivEsc

Why it matters

PEN-200 Linux privilege escalation covers abusing sudo as a core path to root.

How to identify it

  • Run sudo -l
  • Check allowed command
  • Search GTFOBins

Linux commands

sudo -l
sudo -u root /allowed/command
sudo -u root /bin/bash
sudo -u root /usr/bin/vim -c ':set shell=/bin/sh' -c ':shell'

Expected output

  • Matching Defaults/Runas/Command entries
  • NOPASSWD rule

Success looks like

  • root shell
  • Write root-owned file
  • Read proof

Failure looks like

  • Password required
  • Command not exploitable
  • Restricted arguments

Troubleshooting

  • Use exact allowed binary path
  • Check GTFOBins sudo section
  • Check if wildcards exist

Common mistakes

  • Not checking Runas user
  • Not respecting exact path
  • Forgetting environment restrictions

Alternative attacks

  • SUID
  • cron
  • capabilities

What to try next

  • Root proof
  • Credential hunting
  • Report evidence

Recommended next lessons

ASREP Roast

ASREP roasting abuses AD users with Kerberos pre-authentication disabled. You can request encrypted ASREP material and attempt to crack it offline.

Kerberoast

Kerberoasting targets domain users with SPNs. You request service tickets and crack them offline.

GenericWrite

GenericWrite means you can modify certain attributes on the target AD object.

GenericAll

GenericAll is effectively full control over the target AD object.