Never add commands to sudoers without parameters

The server of a friend got hacked. Vulnerable web application, so the attacker had a local shell as the user the webserver ran under (www-data). Ok, but how did the attacker get root? Well.. Let's say that this line in /etc/sudoers.d/some-tool didn't help: www-data ALL=(ALL) NOPASSWD: /usr/bin/apt-get It was for some self-crafted maintenance tool to allow updating of the package lists via a webinterface. The attacker did run sudo -l listing all sudo rules for www-data and there the line above was found. All the attacker had to do was: www-data@host:~$ sudo apt-get update -o APT::Update::Pre-Invoke::=/bin/sh # Et voilá one rootshell to go. Therefore: Always add parameters to your sudo commands! Make them as precise as possible. And if you have a program/binary requiring different parameter combinations: Add them multiple times. As this would have prevented it: www-data ALL=(ALL) NOPASSWD: /usr/bin/apt-get update For the sake of completeness of this demonstration we assigned www-data a…