Privilege Escalation via Writable /etc/sudoers (Conceptual Overview)
The /etc/sudoers file controls sudo privileges. If writable, attackers can grant themselves full sudo access.
⚙️ What is /etc/sudoers?
/etc/sudoers defines which users can run which commands with sudo.
It should only be editable by root via visudo.
🧠 How /etc/sudoers Escalation Happens (High-Level)
- ✔ /etc/sudoers is writable by non-root users
- ✔ Attacker adds line granting full sudo access
- ✔ Attacker runs commands as root
visudo to prevent syntax errors.
🔥 Why Writable /etc/sudoers Is Dangerous
- ✔ Immediate root access
- ✔ Simple to exploit
- ✔ Often overlooked
🌍 Real-World Example (Defensive View)
A misconfigured backup tool makes /etc/sudoers world-writable.
A user adds user ALL=(ALL) NOPASSWD:ALL and gets root.
🔍 Detecting Writable /etc/sudoers
- ✔ Check permissions:
ls -la /etc/sudoers - ✔ Monitor file integrity
🛡️ Preventing /etc/sudoers Escalation
- ✔ Ensure correct permissions (440)
- ✔ Use visudo for edits
- ✔ Regular permission audits
🧾 Key Takeaways
- ✔ /etc/sudoers must not be writable
- ✔ Always use visudo
- ✔ Regular audits are essential
⚙️ /etc/sudoers – Command Awareness
Common commands observed during audits when checking sudoers. Shown for defensive awareness only.
🔍 Permission Checking
-
Check /etc/sudoers permissions
Why used: Verify correct permissions (should be 440).ls -la /etc/sudoers
🛡️ Defender Takeaways
- ✔ Verify /etc/sudoers permissions
- ✔ Monitor file changes
- ✔ Use visudo for edits
