Local privilege escalation via a NOPASSWD sudo rule that trusts an unqualified PATH search
sudoers grants NOPASSWD execution of a backup script as root. The script calls `tar` and `gzip` by bare name instead of an absolute path — planting a malicious `tar` earlier in $PATH turns a routine job into a root shell.
The full write-up is locked
Unlock the step-by-step write-up, screenshots and PoC file by purchasing this listing.
sudoers grants NOPASSWD execution of a backup script as root. The script calls `tar` and `gzip` by bare name instead of an absolute path — planting a malicious...…
Browse the file tree freely — unlock to download.
-
sudo_path_lpe.sh 1.0 KB
Privilege escalation labs
View all labsNo related labs for this topic yet.
Reviews & Questions
Sign in to ask a question or leave a review.
No reviews or questions yet — be the first.
Listing Details
- Author
- cyber_ghost
- Published
- 2026-09-13
- Target / OS
- sudoers NOPASSWD rule allowing a maintenance script to run as root
- Category
- Kernel / LPE
- Payout Method
- No preference
Price
0.0190 BTC
≈ $1,235.00
Live Chat
Ask the seller or other buyers a question — mention someone with @handle
No messages yet — start the conversation.
Sign in to join the conversation.