SUDOERS Commented Code Includes Use for Evil

Thursday, May 31, 2012

Rob Fuller

D8853ae281be8cfdfa18ab73608e8c3f

I found a number of things interesting when reading the following post:

http://www.offensive-security.com/vulndev/freepbx-exploit-phone-home/

Too bad that nmap's interactive mode was taken out, but there are a great number of other such methods, most notably VI's shell mode. 

But when I started looking into appending or inserting lines into /etc/sudoers for CCDC, I happened upon an interesting function of that file. Near the end of the file there are two lines:

# See sudoers(5) for more information on "#include" directives:
#includedir /etc/sudoers.d

Both look commented out, but in actuality, exactly as-is the #includedir line is interpreted and acted upon. So any file that you put in the /etc/sudoers.d directory counts as an extension of the /etc/sudoers file.

Make a small edit to the default README file with a bunch of added # commented out lines copied directly from the sudo man page, with a

nobody ALL = NOPASSWD: ALL

or www-data plus a webshell makes for easy re-exploitation

Just an evil way to stay hidden on a 'nix box… 

Update: 

nmap --script <(echo "os.execute('/bin/sh')")

'nuf said…  (thanks @bonsaiviking )

Cross-posted from Room 362

Possibly Related Articles:
14383
Network->General
Information Security
Application Security Development Secure Coding Nmap Network Security exploit vulnerability SUDOERS
Post Rating I Like this!
Default-avatar
mk MK http://www.burberryfactorys.com/
http://www.shophandbagsonline.com/
http://www.official-coachoutlet.com/
http://www.barbour-factory.com/
http://www.burberry-outlet2014.com/
http://www.gucci-factory.com/
http://www.marcjacobsonsale.com/
http://www.mcmworldwide.ca/
http://www.guccishoes-uk.com/
http://www.kate-spades.com/
http://www.louisvuittonas.com/
http://www.lv-guccishoesfactory.com/
http://www.official-mkoutlets.com/
http://www.official-pradaoutlet.com/
http://www.michael-korsusa.net/
http://www.north-facesoutlet.com/
http://www.moncler-clearance.com/
http://www.north-faceclearance.com/
http://www.clothes-mall.com/
http://www.polo-outlets.com/
http://www.ralphlauren.so/
http://www.ralphlaurentshirts.com/
http://www.ferragamos.in.net/
http://www.longchampsoutlet.com/
http://www.abercrombiee.com/
http://www.barbour-jacketsoutlet.com/
http://www.michael--korsonline.com/
http://www.thenorthface.so/
http://www.cheapuggsbootsr.com/
http://www.beatsbydreoutlet.net/
http://www.tommyhilfiger.in.net/
http://www.ralphslauren.co.uk/
http://www.michaelkors.so/
http://www.oakleyssunglassoutlet.com/
http://www.warm-boots.com/
http://www.tory-burches.com/
http://www.woolrich-clearance.com/
http://www.tommy-hilfigeroutlet.com/
http://www.uggboots-factory.com/
http://www.official-northfaceoutlet.com/
http://www.nike-jordanshoes.com/
http://www.monsterbeatsbydres.net/
http://www.canada-gooser.com/
http://www.bestcustomsonline.com/
http://coach.mischristmas.com/
http://www.coach-blackfriday2014.com/
http://www.coachccoachoutlet.com/
http://www.coach-clearance.com/
http://www.coach-factories.net/
http://www.coach-factorysoutlet.com/
http://www.coachlosangeles.com/
http://www.coachoutletstates.com/
http://www.coach-pursesoutlets.com/
http://www.hermes-outletonline.com/
http://www.misblackfriday.com/
http://www.mischristmas.com/
http://www.mmoncler-outlet.com/
http://www.newoutletonlinemall.com/
http://www.ralphlaurenepolo.com/
http://www.zxcoachoutlet.com/
http://www.misblackfriday.com/uggsale.html
http://www.mischristmas.com/uggboots.html
http://www.newoutletonlinemall.com/coachoutlet.html
http://www.zxcoachoutlet.com/coachoutletonline.html
http://michaelkorsoutlet.mischristmas.com/
http://mcmbackpack.mischristmas.com/
http://monsterbeats.mischristmas.com/
http://northfaceoutlet.mischristmas.com/
http://mk.misblackfriday.com/
http://coachoutlet.misblackfriday.com/
http://coachfactory.misblackfriday.com/
http://uggaustralia.misblackfriday.com/
http://coachpurses.misblackfriday.com/
http://coachusa.misblackfriday.com/
http://coach.misblackfriday.com/
http://michaelkorss.misblackfriday.com/
http://michaelkors.misblackfriday.com/
http://airmax.misblackfriday.com/
http://michael-kors.misblackfriday.com/
https://twitter.com/CoachOutlet2014
https://www.facebook.com/coachoutletstoreonline
https://www.facebook.com/ralphlaurenoutletonline
1418201201
The views expressed in this post are the opinions of the Infosec Island member that posted this content. Infosec Island is not responsible for the content or messaging of this post.

Unauthorized reproduction of this article (in part or in whole) is prohibited without the express written permission of Infosec Island and the Infosec Island member that posted this content--this includes using our RSS feed for any purpose other than personal use.