exploiting-sudo-suid-and-cron-misconfigurations

Run sudo -l to list allowed commands and preserved environment variables. If a GTFOBins-capable binary like vim, less, awk, or find is allowed, shell out with commands like sudo vim -c '!sh'. If env_keep preserves LD_PRELOAD, compile a shared object that calls setuid(0) and run sudo LD_PRELOAD=/tmp/pe.so <allowed_cmd>.

Find SUID binaries with find / -perm -4000 -type f, then inspect them with strings for commands called without absolute paths. Hijack execution by prepending a writable directory to PATH with a trojan of the same name, or export a malicious bash function matching the absolute command path.

Wildcard injection occurs when a privileged script runs a command like tar -czf backup.tgz * over an attacker-writable directory. Filenames beginning with a dash are interpreted as flags, so planting --checkpoint=1 and --checkpoint-action=exec=sh shell.sh causes tar to execute shell.sh as root.

Use sudo -l for sudo policy, find with -perm -4000/-2000 for SUID/SGID binaries, and crontab -l plus /etc/cron* inspection for scheduled jobs. pspy watches real process argv without root to catch cron PATH and wildcard abuse, while linpeas automates broad discovery.

These techniques are intended only for authorized engagements after obtaining an unprivileged shell on a target Linux system. They apply when sudo rules, SUID binaries, cron jobs, or privileged scripts contain misconfigurations, and each vector should be confirmed with a marker such as a SUID bash copy.