Sudo

From enterprise
Jump to: navigation, search
Sudo
Technique
ID T1169
Tactic Privilege Escalation
Platform Linux, MacOS, OS X
Permissions Required User
Effective Permissions root
Data Sources File monitoring

The sudoers file, /etc/sudoers, describes which users can run which commands and from which terminals. This also describes which commands users can run as other users or groups. This provides the idea of least privilege such that users are running in their lowest possible permissions for most of the time and only elevate to other users or permissions as needed, typically by prompting for a password. However, the sudoers file can also specify when to not prompt users for passwords with a line like user1 ALL=(ALL) NOPASSWD: ALL1.

Adversaries can take advantage of these configurations to execute commands as other users or spawn processes with higher privileges. You must have elevated privileges to edit this file though.

Mitigation

The sudoers file should be strictly edited such that passwords are always required and that users can’t spawn risky processes as users with higher privilege. By requiring a password, even if an adversary can get terminal access, they must know the password to run anything in the sudoers file.

Detection

On Linux, auditd can alert every time a user's actual ID and effective ID are different (this is what happens when you sudo).