Sudo misconfig (NOPASSWD)
/etc/sudoers allows a user to run a binary as root without password.
Category: Linux · Privilege Escalation 🎯 Trench —/etc/sudoers allows a user to run a binary as
root without password. If that binary is interactive (vim,
less, find, awk) → escape to root shell with
GTFOBins.
🔗 Kill chain — sudo -l lists what’s permitted. If you see
NOPASSWD, look up the binary in GTFOBins and apply the recipe.
📡 Defensive footprint — Event in /var/log/auth.log with
COMMAND=/usr/bin/vim. Obvious audit if someone reviews; rarely
done.
⚠️ False friend — Assuming the GTFOBins recipe works on every
distro. Some shells or busybox versions lack features (!sh in
vim requires full vim, not vim.tiny).
🛡️ Remediation — Specific sudo rules, never ALL for
interactive binaries. Periodic audit with sudo -l.
← Back to the full glossary Last updated: 2026-06-11