Scrutiny_sudo_privileges_briand

briand

---

Checking for sudo privileges of the briand user after making the lateral movement

briand@onlyrands:~$ sudo -l
Matching Defaults entries for briand on onlyrands:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
 
User briand may run the following commands on onlyrands:
    (root) NOPASSWD: /usr/bin/systemctl status teamcity-server.service

The briand user is able to execute the /usr/bin/systemctl status teamcity-server.service command as the root account without getting prompted for password

systemctl

---

While the sudo command appears innocent, the systemctl binary uses less as a default pager This would mean that the current sudo privileges extends to executing the less binary

and that’s well explained in GTFObins Moving on to the privilege escalation phase