A penetration tester has gained initial access to a Linux system and wants to escalate privileges. Running `sudo -l` reveals the following:

```text
User pentest may run the following commands on target:
(ALL) NOPASSWD: /usr/bin/find
```

Which command would MOST likely achieve privilege escalation using this sudo permission?

Question

A penetration tester has gained initial access to a Linux system and wants to escalate privileges. Running `sudo -l` reveals the following:

```text
User pentest may run the following commands on target:
    (ALL) NOPASSWD: /usr/bin/find
```

Which command would MOST likely achieve privilege escalation using this sudo permission?

Accepted Answer

B. sudo find /etc -exec /bin/bash -p \; -quit. The `find` command with the `-exec` flag can execute arbitrary commands. When run with `sudo`, the executed command also runs as root. The command `sudo find /etc -exec /bin/bash -p \; -quit` uses `-exec` to spawn a privileged bash shell. This is a documented GTFOBins privilege escalation technique for `find` when it has sudo permissions without password.

Related Questions

Discussion