Abusing a sudo rule

If less runs as root, it reads root's files

When you run sudo less somefile, less runs as root. And less opens whatever file you point it at. Point it at the root-only flag:

sudo less /root/root.txt | cat

In the terminal (less runs as root and reads the file your own account cannot)

student@vulntech:~$ sudo less /root/root.txt | cat
vulntech{r00t_on_the_box_privesc}

Piping to cat just makes less print the file and exit instead of opening its full-screen pager — handy here. Run sudo less /root/root.txt on its own and you get the pager; press q to quit.

From file-read to a full shell

less can do more than read: from inside its pager you can type !/bin/sh to launch a shell, and since less is running as root, that shell is a root shell. That is the general lesson:

• Any program you may run under sudo acts with root's privileges.
• Many ordinary programs can read files, write files or spawn a shell — GTFOBins lists the trick for each.
• So a single over-broad sudo rule, even for a ‘safe’ tool like a pager, is a full compromise.