When a sudo rule is too generous

Read the rules you grant

sudo rules are exceptions that let a user run a command as root. They are easy to write too broadly. Look at the rule that has been left for student:

cat /etc/sudoers.d/student-maint

In the terminal (student may run less as root, with no password)

student@vulntech:~$ cat /etc/sudoers.d/student-maint
cat: /etc/sudoers.d/student-maint: Permission denied

That looks harmless — less only views files, right? But from inside less you can type !/bin/sh to spawn a shell, and because less is running as root, it is a root shell. A NOPASSWD rule for a pager is effectively a grant of full root.

Tip: Programs that can run other programs or write arbitrary files — editors, pagers, find, awk, tar — should almost never be in a sudo rule. GTFOBins lists what each one can be abused to do.