exploiting-sudo-suid-and-cron-misconfigurations

name	exploiting-sudo-suid-and-cron-misconfigurations
description	Local privilege escalation through sudo rule abuse (GTFOBins, SETENV/LD_PRELOAD/BASH_ENV/PYTHONPATH), SUID/SGID binaries, writable cron jobs and cron PATH hijacking, and wildcard (glob) argument injection against privileged tar/rsync/zip/chown/tcpdump invocations during authorized engagements.
domain	cybersecurity
subdomain	linux-hardening
tags	["penetration-testing","linux","sudo","suid","cron","privilege-escalation"]
version	1.0
author	xalgorix
license	Apache-2.0

Exploiting Sudo, SUID, and Cron Misconfigurations

When to Use

• During authorized local privilege escalation after obtaining an unprivileged shell
• When sudo -l reveals NOPASSWD entries, SETENV, or preserved environment variables
• When SUID/SGID binaries or root-owned writable scripts are present
• When cron/systemd timers run scripts on writable paths or with an unsafe PATH
• When a privileged script processes a wildcard (*) over an attacker-writable directory

Critical: Techniques Most Often Missed

Testers run sudo -l, see a binary they don't recognize, and stop. The escalation usually hides in environment handling, relative paths, and wildcard argument injection.

• Wildcard / glob argument injection. A privileged tar/rsync/zip/chown/7z/tcpdump * lets you plant filenames that begin with - and become flags.
  • How to CONFIRM: in the writable dir create --checkpoint=1 and --checkpoint-action=exec=sh shell.sh (tar); after the root job runs, shell.sh executed as root (check your /tmp/pwn marker).
• Preserved env vars in sudo. env_keep+=LD_PRELOAD, BASH_ENV, PYTHONPATH, LD_LIBRARY_PATH all yield root code execution.
  • How to CONFIRM: sudo -l lists the kept var; e.g. sudo LD_PRELOAD=/tmp/pe.so <allowed_cmd> spawns a root bash.
• SUID/sudo binary calling a command without an absolute path. Hijack via PATH or an exported bash function.
  • How to CONFIRM: strings <suid> shows a bare command name (e.g. service); after export PATH=/tmp:$PATH with a trojan, running it gives root.
• Root-owned SUID wrapper that runs a writable script. Append to the script, run the wrapper.
  • How to CONFIRM: ls -l shows the wrapped .sh is writable; appending chmod +s /bin/bash then running the wrapper leaves a SUID bash.
• less/vim/awk/find via sudo (GTFOBins shell-out). A "harmless" file-viewer sudo rule shells out.