Is sudo the only option for root privilege escalation? We don't use sudo (we cannot ev

Hi, <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url=

<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/us

Support su for root privilege escalation about vuls HOT 4 CLOSED

future-architect commented on August 16, 2024

Support su for root privilege escalation

from vuls.

kotakanbe commented on August 16, 2024

Hi, @E-M
Please tell me the details of your method for root privilege escalation.
Thanks.

from vuls.

E-M commented on August 16, 2024

Basically it is just like su, you run command like:
su -c "some_command"

The problem is not that you don't support su or other method, the problem is that you have hardcoded sudo.

from vuls.

sadayuki-matsuno commented on August 16, 2024

@E-M
Sorry for being late.
I have a question.
Are you okey if you use su method(instead of sudo) without password?

from vuls.

kotakanbe commented on August 16, 2024

--ask-sudo-password was deleted for security reasons.
Because plain sudo password have to be passed via pipe in shell.
The same can be said about su.

So, Vuls supports sudo + NOPASSWD in /etc/sudoers on the target server for now. ( see https://github.com/future-architect/vuls#usage-configtest section)

from vuls.