Privilege Escalation

​

Why Use sudo?

• Grants temporary elevated rights without sharing the root password
• Provides an audit trail of executed commands
• Limits users to only the commands they need

​

Attempting a Restricted Operation

$ apt install nginx
E: Could not open lock file /var/lib/dpkg/lock-frontend - open (13: Permission denied)
E: Unable to acquire the dpkg frontend lock (/var/lib/dpkg/lock-frontend), are you root?

​

Elevate with sudo

$ sudo apt install nginx
[sudo] password for michael: 

​

Configuring sudo: /etc/sudoers

sudo visudo

# User privilege specification
root    ALL=(ALL:ALL) ALL

# Members of the admin group may gain root privileges
%admin  ALL=(ALL)       ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL)   ALL

# Allow mark to run any command
mark    ALL=(ALL:ALL)   ALL

# Allow sarah to reboot the system
sarah   localhost=/usr/bin/shutdown -r now

# See sudoers(5) for more information on "#include" directives:
#includedir /etc/sudoers.d

​

Best Practices for sudo Configuration

• Grant only the commands necessary for a task
• Use group-based rules to simplify management
• Avoid NOPASSWD unless automation requires it
• Keep custom rules in /etc/sudoers.d/ for modularity

​

Hands-On Exercises

1. Create a test user:
   sudo useradd -m bob
   sudo passwd bob
   
2. Add the user to the sudo group:
   sudo usermod -aG sudo bob
   
3. Switch to bob and install a package:
   su - bob
   sudo apt update && sudo apt install htop
   
4. Customize a rule in /etc/sudoers.d/custom_rules to allow bob to restart services without a password.

​

Links and References

• sudo Manual Page
• Visudo Documentation
• Principle of Least Privilege
• Kali Linux Privilege Escalation Guide