One thing we've been getting away with throughout this entire course is being able to run programs
inside of our POSIX-based world with admin or root-level permissions with little to no fuss.
That's because Ubuntu and POSIX-based operating systems are very particular about how they allow
users to run programs and what level and what types of programs they can be ran
based on permissions. But we've been using sudo whenever we run commands because we don't want
to log in as root. We just want to be able to run commands at that elevated level with little to no
yacking back from the actual operating system itself. That's right, I'm talking to you Ubuntu.
As we swap over and I show you that we're inside the terminal here to give you the first part of
what we're discussing, and that is weak sudo policy. Because by default, sudo has its own
rules and regulations tied to it, but it is possible that we'll run across some systems
within an organization for whatever reason that has an altered sudo policy, thus making it easier
for regular users to be able to access those higher level permissions. And one particular
area that we can do this is inside a terminal running sudo l, as you can see here. And again,
commands below. But what we're really taking a look at right now, and I'm going to highlight
before we zoom in for us here, is the all, all, all right there that we see. Now I'm going to
properly zoom in for us. And there we go. And what this really means for us is that
when you ever see all, all, all, it means that you have full root privileges. But that middle
all is there for us to be able to require the use of a password into sudo for all users trying to
use sudo. In a worst case scenario, you will see all, no password, and all is the last one, meaning
that everybody can run sudo, no password required. And once you have something like that enabled,
that means that anybody and everybody can be the root level administrator on a system in our
Linux environment here, because there's no password check or any kind of authentication
check for us to be able to prevent improper use. Now as a pentester, if you run across this
particular instance, that's good for us, bad for them. How do we know as pentesters if this is the
actual case? Well, as a regular user, you notice above that I ran sudo-l. And even though I'm
logged in as learner, if this required a password, you, which it did, you see that it asked for a
password for learner. And I'm correcting myself before I make a mistake here, because you could
run this in as a regular user and not have a password check on it. But in this particular
instance, it did. And if we were remoted into the system, we would get checked on it as well too.
We're just verifying the policy real quick. And speaking of verifying policy, there is a sudo
policy on the system that works very similar to how group and local security policy works inside
of that Windows world. In order for us to be able to see this, we have to go to sudo cat slash
etsy slash sudoers, plural. Yes. And inside of here, we get a more broken down detailed version
of what it is that we saw up top. And I would encourage you to definitely go take a look at
this because this can be modified to allow you to enforce more permissions or more security measures
or loosen them all up. And so much so that this has been used that the last update that we got
for sudo apt update and the kernel update itself addressed a CVE that had problems with the actual
use of sudo. Now it's a very old CVE, but it, nonetheless, it was modified in here.
And you can see that the file must be edited with vi-sudo running as root because you don't want
regular users going in and changing admin commands. But in here, this is showing us
the basically the environment of sudo and the rules that are contained within. And the last
few lines that I've highlighted right here for you, and I'll zoom in, specifically talk about
user privilege specification members and the allowed members to be able to execute what
commands when they do have sudo. And this is a default configuration. And while this does require
everybody to put in a password for sudo on a Linux operating system in Ubuntu here,
one thing that it does not limit is the ability of which programs are restricted. So basically,
if you can run sudo, you can run anything on the system itself. There's no check or balance as to
who can run what. So once you have the password, boom, it's game on on the actual system overall.
Now, if you tighten this up a little bit, and I'm sure we can get into this later on in the course,
or definitely check out some of the stuff James has done here on CBT Nuggets with his Linux courses,
because you could actually tighten this down to the point where you can create different
environmental variables of which users can do what using what levels of sudo permissions.