b3rito/yodo

Local Privilege Escalation

yodo's Issues

syntax error checking for "man"

the | grep -ic.... in the cMan check errors out because the preceding grep -v commands redirects to check1.txt rather than stdout. Below is a fix that I hope will work.

Kind regards,

Erick.

erick@mx:~/yodo$ diff -bitwc ORIGyodo.sh yodo.sh
*** ORIGyodo.sh 2016-11-19 22:54:33.708359846 -0600
--- yodo.sh     2016-11-19 23:13:00.311737211 -0600
***************
*** 80,86 ****
  cIrb=$( grep -ic "irb" check.txt )
  cLess=$( grep -ic "less" check.txt )
  cMore=$( grep -ic "more" check.txt )
! cMan=$( cat check.txt | grep -v commands > check1.txt | grep -ic "man" check1.txt )
  cGdb=$( grep -ic "gdb" check.txt )
  cRuby=$( grep -ic "ruby" check.txt )
  cB3=$( grep -ic "NOPASSWD" check.txt )
--- 80,86 ----
  cIrb=$( grep -ic "irb" check.txt )
  cLess=$( grep -ic "less" check.txt )
  cMore=$( grep -ic "more" check.txt )
! cMan=$( grep -v commands check.txt | grep -ic "man" )
  cGdb=$( grep -ic "gdb" check.txt )
  cRuby=$( grep -ic "ruby" check.txt )
  cB3=$( grep -ic "NOPASSWD" check.txt )

checking for user-writable files and directories

Hi, there. I love the idea of this project, thought I'd offer a contribution. Whenever I test for vulnerable sudo configurations, a helpful check is to see if I am able to overwrite a sudo-enabled command with my own. Below is a small script I wrote to automate that process, would be neat if something along the same lines was part of yodo!

Cheers,

Erick.

#!/bin/bash
PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin

VICTORY=1
for POTENTIAL in `sudo -l | awk '{for (i = 1; i <= NF; i++) print $i}'|grep -e ^/|sed -e "s/,$//"`
do
        >&2 echo "Testing [${POTENTIAL}]..."
        # if we can write to this, it's game over
        sudo -l $POTENTIAL > /dev/null 2> /dev/null
        if [ $? -eq 0 -a -w $POTENTIAL -a -x $POTENTIAL ] ; then
                echo "[*] $POTENTIAL is writable and executable, likely privesc issue for command ${POTENTIAL}"
                VICTORY=0
        fi
        # if we can't write to the executable file itself, maybe we can write to one of its parent directories
        DIRNAME=`dirname $POTENTIAL`
        while [ ! -z "${DIRNAME}" ] ;
        do
                >&2 echo "Testing [${DIRNAME}]..."
                if [ -w ${DIRNAME} ] ; then
                        echo "[*] ${DIRNAME} is writable, likely privesc issue for command ${POTENTIAL}"
                        VICTORY=0
                        break
                fi
                OLD_DIRNAME=${DIRNAME}
                DIRNAME=`dirname ${DIRNAME}`
                if [ "x${OLD_DIRNAME}" = "x${DIRNAME}" ] ; then
                        #we've reached /
                        break
                fi
        done
done
exit $VICTORY