← Learn
Dangerous
sudo -u '#-1' /usr/bin/id

linux · bash · Nightmare

Requests execution as user id -1, which on unpatched sudo wrapped around to zero and produced root even when the sudoers rule explicitly excluded it. Recognising the shape matters more than the specific bug: a numeric user id in quotes is never an ordinary invocation.

Signals to notice

  • Numeric user id used to dodge a sudoers restriction
  • Negative id relies on integer wraparound
  • Targets a rule that was meant to deny root

Think you can spot these under time pressure?

Start Training

More Privilege Escalation