Skip to content

Latest commit

 

History

History
27 lines (18 loc) · 1.15 KB

T1169.md

File metadata and controls

27 lines (18 loc) · 1.15 KB

T1169 - Sudo

The sudoers file, /etc/sudoers, describes which users can run which commands and from which terminals. This also describes which commands users can run as other users or groups. This provides the idea of least privilege such that users are running in their lowest possible permissions for most of the time and only elevate to other users or permissions as needed, typically by prompting for a password. However, the sudoers file can also specify when to not prompt users for passwords with a line like user1 ALL=(ALL) NOPASSWD: ALL (Citation: OSX.Dok Malware).

Adversaries can take advantage of these configurations to execute commands as other users or spawn processes with higher privileges. You must have elevated privileges to edit this file though.

Atomic Tests


Atomic Test #1 - Sudo usage

Common Sudo enumeration methods.

Supported Platforms: macOS, Linux

Run it with sh!

sudo -l
sudo su
cat /etc/sudoers
vim /etc/sudoers