SUDO_KILLER - 旨在利用权限升级的工具

项目说明

!Static Badge
!GitHub last commit (branch)
!Static Badge
!Static Badge
![License]()

:star: Star us on GitHub — to show your support!

<p align="left">
<img width="100%" src=" alt="logo"/>
</p>

![Twitter]()
![LinkedIn]()

:bulb: Best in Dark Mode :)

The project SUDO_KILLER made it to the final for the SANS Difference Award 2023 in the category open-源码 工具.

<p align="left">
<img width="45%" height="30%" src=" alt="SANS-DMA"/>
</p>

Contributing

- Stargazers over time
- Support
- Credits
- Disclaimer
- License

<a name="intro"></a>

Introduction

SUDO_KILLER is a 工具 geared towards cyber security practitioners (pentesters, security auditors, system admins, CTF players and Infosec students), facilitating pri escalation within Linux en. It focuses on tied to SUDO usage, including misconfigurations in sudo rules, weaknesses (CVEs and other ), and risky binary deployments (GTFOBINS). These weak points can be exploited to gain ROOT-le or impersonate other users.

SUDO_KILLER provides a catalog of potential commands and local exploits for manual pri ele. Importantly, it refrains from automated exploitation, requiring users to carry out the exploitation process themselves as per its intended usage.

<a name="check"></a>

Checks

Below is a list of checks that are perform by SUDO_KILLER

Misconfigurations

Dangerous Binaries (GTFOBINS)

of sudo - CVEs

Sudo and misconfiguration related to 3rd party apps

Dangerous En

Credential Har

Writable directories where scripts reside

Binaries that might be replaced

Identify missing scripts

...

> [!WARNING]
> The check list above is NOT exhaustive.

<a name="usage"></a>

Usage

To get started with SUDO_KILLER, you can either git clone or download the zip. If you want to practice and/or test it, there is a testing en (using docker). See the related video which provides an o on how to setup the docker and run SUDO_KILLER. Several scenarios can be setup in the docker en and can be used for testing different misconfigurations or flaws. Alternatively, you can run it on the system to be audited to check for misconfigurations and/or flaws related to sudo.

Optional arguments:
</br>-c : includes C</br>
-a : includes C to third party apps/devices </br>
-i : import (offline mode) from extract.sh </br>
-e : include export of sudo rules / sudoers file </br>
-r : report name (save the output) </br>
-p : path where to sa and report </br>
-s : supply user password for sudo checks (If sudo rules is not accessible without current user's password) </br>
-h : help

> [!NOTE]
> It is worth noting that when using the -c argument, two types of check are provided one for which the C is solely based on the current sudo being used and another where the requirements are also checked.
> Very often, a sudo might be but some pre-requisites might be needed for a successful exploitation.

> [!NOTE]
> Pro password: If a password is needed to run sudo -l then the script will not work if you don't provide a password with the argument -s.

<a name="docker"></a>

Docker ( testing en)

<p align="left">
<img width="25%" src=" alt="-dockerlogo"/>
</p>

A range of Docker containers is made a to offer a deliberately en for testing and hands-on experimentation with SUDO_KILLER as well as with the .

Why is it possible to run "sudo -l" without a password?

By default, if the NOPASSWD tag is applied to any of the entries for a user on a host, you will be able to run "sudo -l" without a password. This behavior may be o via the and listpw options.

However, these rules only affect the current user, so if user impersonation is possible (using su), sudo -l should be launched from this user as well.

Sometimes the file /etc/sudoers can be read even if sudo -l is not accessible without password.

<a name="scenarios"></a>

Scenarios

To switch scenario (To prevent conflicts between the different scenarios) on the docker (demo3):

<a name=""></a>

- Demo

Setup and exploitation

The playlist can be found here:

> [!IMPORTANT]
> Quick on how to properly do the testing on the provided docker.

<details open>
<summary>
(click to expand) Usage : How to setup and use the provided testing en (docker)
</summary> <br />

<p align="center">
<a href="
<img width="39%" src=" alt="apis"/>
</a>
&nbsp;
<a href="
<img width="39%" src=" alt="apis"/>
</a>
</p>

<p></p>

</p>
</details>

> [!WARNING]
> The video list below is not exhaustive, to ha to all the , please check the playlist link.

<details open>
<summary>
Several are provided below with different scenarios of exploitation.
</summary> <br />

<p align="center">
<a href="
<img width="39%" src=" alt="apis"/>
</a>
&nbsp;
<a href="
<img width="39%" src=" alt="apis"/>
</a>
</p>

<p align="center">
<a href="
<img width="39%" src=" alt="apis"/>
</a>
&nbsp;
<a href="
<img width="39%" src=" alt="apis"/>
</a>
</p>

<p align="center">
<a href="
<img width="39%" src=" alt="apis"/>
</a>
&nbsp;
<a href="
<img width="39%" src=" alt="apis"/>
</a>
</p>

<p align="center">
<a href="
<img width="39%" src=" alt="apis"/>
</a>
&nbsp;
<a href="
<img width="39%" src=" alt="apis"/>
</a>
</p>

<p align="center">
<a href="
<img width="39%" src=" alt="apis"/>
</a>
&nbsp;
<a href="
<img width="39%" src=" alt="apis"/>
</a>
</p>

<p align="center">
<a href="
<img width="39%" src=" alt="apis"/>
</a>
&nbsp;
<a href="
<img width="39%" src=" alt="apis"/>
</a>
</p>

</details>

<a name="CVEs"></a>

CVEs

<details open>
<summary>
(click to expand) C to SUDO that SUDO_KILLER detects (including pre-requisites):
</summary> <br />

<p align="center">
<a href="
<img width="39%" src=" alt="apis"/>
</a>
&nbsp;
<a href="
<img width="39%" src=" alt="apis"/>
</a>
</p>

<p align="center">
<a href="
<img width="39%" src=" alt="apis"/>
</a>
&nbsp;
<a href="
<img width="39%" src=" alt="apis"/>
</a>
</p>
&nbsp;
<p align="center">
<a href="
<img width="39%" src=" alt="apis"/>
</a>
&nbsp;
<a href="
<img width="39%" src=" alt="apis"/>
</a>
&nbsp;
</p>
<p align="center">
<a href="
<img width="39%" src=" alt="apis"/>
</a>
&nbsp;
</p>

</details>

<details open>
<summary>
(click to expand) Recent CVEs of 3rd party apps/devices related to sudo that SUDO_KILLER detects (including pre-requisites):
</summary> <br />

<p align="center">
<a href="
<img width="39%" src=" alt="apis"/>
</a>
&nbsp;

</p>

</details>

<a name="sk-tools"></a>

SK-Tools

3 of SUDO_KILLER now includes a list of tools that can be used to achie tasks. The scripts are located at SUDO_KILLERv3/SUDO_KILLER/SK-Tools/

<b><代码>SK-ImperBruteForce-NoPwd.sh</代码></b>: Perform an impersonation bruteforce using users from <代码>/etc/passwd</代码>, starting from user with UID 1000.

<b><代码>SK-credHarvest2.sh</代码></b>: Perform a credential capture by creating a fake <代码>sudo</代码> then redirect to real <代码>sudo</代码>.

<b><代码>SK-app-check.sh</代码></b>: Perform check of sudo related to a specific third-party app, device, or programming language <i>(still in progress)</i>.

<b><代码>SK-ttyInject.sh</代码></b>: Abuses TTY pushback so that if root uses <代码>su -</代码> on a controlled user, an arbitrary command is executed.

<b><代码>SK-recursi.sh</代码></b>: Perform identification of recursi with a default depth of 3.

<b><代码>SK-alias-report.sh</代码></b>: Perform search on aliases with different criteria.

<b><代码>SK-csuid-with-sudo.sh</代码></b>: Identify custom SUID binaries and check whether <代码>sudo</代码> is run without full path.

<b><代码>SK-su-BruteForce.sh</代码></b>: Perform password bruteforce or spray for a specific user via <代码>sudo</代码>.

<b><代码>SK-search-sudoers.sh</代码></b>: Identify possible <代码>sudoers</代码> backup files on the current host.

<details open>
<summary>
(click to expand) Usage : SK-Tools
</summary> <br />

<p align="center">
<a href="
<img width="39%" src=" alt="apis"/>
</a>
&nbsp;
<a href="
<img width="39%" src=" alt="apis"/>
</a>
</p>

<p align="center">
<a href="
<img width="39%" src=" alt="apis"/>
</a>
&nbsp;
<a href="
<img width="39%" src=" alt="apis"/>
</a>
</p>

<p align="center">
<a href="
<img width="39%" src=" alt="apis"/>
</a>
&nbsp;
<a href="
<img width="39%" src=" alt="apis"/>
</a>
</p>

<p align="center">
<a href="
<img width="39%" src=" alt="apis"/>
</a>
&nbsp;
<a href="
<img width="39%" src=" alt="apis"/>
</a>
</p>

</details>

</br>

Capturing Credentials via sudo redirect (SK-credHarvest2.sh)

The script SK-credHarvest2.sh from SK-Tools allow to perform a credential capture by creating a fake sudo then re-direct to real sudo. Actually works only for bash (not working/implemented for ZSH or else for now)configured linux.

The displayed message when asking for credential when using sudo differs from the being used. It is possible to choose between two options (differ based on OS ).
Example of the displayed message (new and old)

> [!TIP]
> (new) [sudo] password for user: <br />
> (old) Password:

For All Users (auser):
When you have root pri or excessi on users' home and you want an easy way to gather credentials:

For the currrent user (cuser):

> [!CAUTION]
> TO STOP the credential har: run the same script again with same argument

output: the log /tmp/sk-crds.log will contains the credentials

Alias' Audit (SK-alias-report.sh)

You will either need root pri, access to a backup of sudoers or read access to /etc/sudoers.

Bruteforce/Password Spray via su (SK-su-BruteForce.sh)

Using su to bruteforce password and password spray with concurrency, timeout and sleep.

Search for backup of the file sudoers (SK-search-sudoers.sh)

Find possible sudoers backup files in /mnt/ /opt/ /etc/ /etc/ /home/ /app*/ and any additional one parse as argument

Update dangerous bins - GTFOBINS (SK_dbins_update.sh)

To update the dangerous bins, go to dbins/update and run ./SK_dbins_update.sh. Make sure you ha connection.

Binary Relative Path (SK-relati.sh)

Looking for binaries with relative path that be abused! if there is no secure_path set.

<a name="contribute"></a>

Contributing

SUDO_KILLER is an open-源码 project and highly appreciate any contributions. Whether you are helping us fix bugs, proposing new features, improving our documentation or spreading the word - we would love to have you as a contributor. Please reach me on twitter or Linkedin if you have any suggestions, feedback or want to contribute, you can also create a Pull Request. I am looking for contribution on the sudo C to 3rd party (I have a list of about 175) and any help would be appreciated.

Bug Report: If you see an error message or run into an issue while using SUDO_KILLER, please create a bug report.

Feature Request: If you have an idea or you're missing a capability that would make de easier and more robust, please submit a feature request.

<a name="stars"></a>

Stargazers over time

Thank you all for your support!

![Stargazers over time]()

<a name="support"></a>

Support

<a href="
<img src=" width="160">
</a>

<a name="credits"></a>

Credits

I crafted the script independently, le online resources from GitHub and other sources in the wild. Acknowledgments are also due to the creators/publishers of exploits associated with the CVEs. You can trace back their details and references in the exploit itself, as well as in the accompanying notes when the 工具 is executed. Notable recognition extends to Puydoyeux, whose inspiration spurred the de of this 工具, and Koutto, for in assistance in handling Docker intricacies and enhancing the 工具's functionality. Additionally, a heartfelt thank you goes out to Emilio Pinna (norbemi) and Andrea Cardaci (cyrus_and) for their in contributions to GTFO Bins, which significantly influenced this project's de.

<a name="disclaimer"></a>

Disclaimer

This script is for educational purpose ONLY. Do not use it without permission of the owner of the system you are running it in. The usual disclaimer applies, especially the fact that me (TH3xACE) is not liable for any damages caused by direct or indirect use of the information or functionality provided by this project. The author (TH3xACE) or any Internet provider bears NO responsibility for content or misuse of these programs or any deri thereof. By using these programs you accept the fact that any damage (dataloss, system crash, system compromise, etc.) caused by the use of the script is not the author responsibility.

<a name="license"></a>

License

SUDO_KILLER is licensed under the MIT license, proper credits is expected whenever used. Please consider to donate for any commercial use.

项目信息

开发语言：Shell

Star 数：2486

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A 工具 designed to exploit a pri escalation in the sudo program on Unix-like systems. It takes ad of a specific misconfiguration or flaw in sudo to gain elevated pri on the system, essentially allowing a regular user to execute commands as the root user.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。