sudo is a powerful utility in Unix-like systems that allows permitted users to execute commands with elevated privileges. However, misconfigurations and certain vulnerabilities can be exploited to escalate privileges, potentially compromising system security.

SUDO_KILLER is a shell script designed to assist security professionals in identifying such misconfigurations and vulnerabilities within sudo configurations.

It focuses on vulnerabilities tied to SUDO usage, including misconfigurations in sudo rules, version-based weaknesses (CVEs and other vulnerabilities), and risky binary deployments (GTFOBINS). These weak points can be exploited to gain ROOT-level privileges or impersonate other users.

---

What is SUDO_KILLER?

Developed by TH3xACE, SUDO_KILLER is a Bash script that performs a series of checks to identify:

• Misconfigurations in sudo rules
• Presence of dangerous binaries (e.g., those listed in GTFOBins)
• Vulnerable versions of sudo susceptible to known CVEs
• Dangerous environment variables
• Writable directories containing scripts
• Binaries that might be replaced
• Missing scripts referenced in sudo configurations

The tool generates a report detailing potential privilege escalation vectors but does not perform any exploitation itself.

---

Key Features

• Comprehensive Checks: Identifies various misconfigurations and vulnerabilities related to sudo.
• CVE Detection: Checks for known vulnerabilities in the installed version of sudo.
• Export Functionality: Can export sudo rules and configurations for offline analysis.
• Offline Mode: Supports analyzing extracted data from a target system without direct execution on it.
• Report Generation: Produces detailed reports outlining findings and potential exploitation paths.

---

Usage

To run SUDO_KILLER:

Options:

• -c: Include CVE checks
• -e: Export sudo rules and configurations
• -r: Specify report filename
• -p: Specify path to save exports and report
• -s: Supply user password for sudo checks (if required)
• -h: Display help message

Conclusion

SUDO_KILLER is a valuable tool for security professionals aiming to audit sudo configurations for potential privilege escalation vectors. By identifying misconfigurations and known vulnerabilities, it aids in strengthening system security.

You can download SUDO_KILLER or read more here.