50 Shades of Sudo Abuse: Linux Privilege Escalation via Sudo Misconfigurations
Tyler Boykin reviews Linux privilege escalation vectors stemming from sudoers misconfigurations, from common GTFOBins low-hanging fruit to subtle binary abuse.
Summary
The Central Role of Sudo in Linux Access Control
Linux system administrators frequently grant unprivileged users specific sudo rights to run routine maintenance utilities without providing full root access.
Deconstructing Sudoers File Misconfigurations
Tyler Boykin analyzes common syntax oversights, wildcard abuses, and insecure environment variable preservation (`env_keep`, `LD_PRELOAD`) in `/etc/sudoers`.
Weaponizing Standard Binaries for Root Shells (GTFOBins)
The speaker demonstrates abusing text editors (vim, nano), pagers (less, more), scripting runtimes (python, perl), and archive utilities to break out into interactive root shells.
Hardening Guidelines and Least-Privilege Sudo Policies
The presentation provides system administrators with best practices for configuring sudoers rules, command whitelists, and auditing sudo execution logs.
Related talks
Red Team Village·24 min
Austin Marck
Austin Marck demonstrates red team tradecraft for targeting SAP and ERP platforms, demonstrating protocol exploitation, RFC abuse, and business logic takeover.
Creator Stage·46 min
Philip Young
Demonstrates practical attack paths against IBM z/OS Unix System Services, showing how weak file permissions and buffer overflows allow privilege escalation on mainframes.
Main Stage·20 min
Cernica Ionut Cosmin
Explores techniques for harvesting cached credentials, environment tokens, and process memory artifacts across multi-tenant shared Linux systems.