Skip to content

T1548.003 Sudo and Sudo Caching

Adversaries may perform sudo caching and/or use the sudoers file to elevate privileges. Adversaries may do this to execute commands as other users or spawn processes with higher privileges.

Within Linux and MacOS systems, sudo (sometimes referred to as “superuser do”) allows users to perform commands from terminals with elevated privileges and to control who can perform these commands on the system. The sudo command “allows a system administrator to delegate authority to give certain users (or groups of users) the ability to run some (or all) commands as root or another user while providing an audit trail of the commands and their arguments.”1 Since sudo was made for the system administrator, it has some useful configuration features such as a timestamp_timeout, which is the amount of time in minutes between instances of sudo before it will re-prompt for a password. This is because sudo has the ability to cache credentials for a period of time. Sudo creates (or touches) a file at /var/db/sudo with a timestamp of when sudo was last run to determine this timeout. Additionally, there is a tty_tickets variable that treats each new tty (terminal session) in isolation. This means that, for example, the sudo timeout of one tty will not affect another tty (you will have to type the password again).

The sudoers file, /etc/sudoers, describes which users can run which commands and from which terminals. This also describes which commands users can run as other users or groups. This provides the principle of least privilege such that users are running in their lowest possible permissions for most of the time and only elevate to other users or permissions as needed, typically by prompting for a password. However, the sudoers file can also specify when to not prompt users for passwords with a line like user1 ALL=(ALL) NOPASSWD: ALL.2 Elevated privileges are required to edit this file though.

Adversaries can also abuse poor configurations of these mechanisms to escalate privileges without needing the user’s password. For example, /var/db/sudo‘s timestamp can be monitored to see if it falls within the timestamp_timeout range. If it does, then malware can execute sudo commands without needing to supply the user’s password. Additional, if tty_tickets is disabled, adversaries can do this from any tty for that user.

In the wild, malware has disabled tty_tickets to potentially make scripting easier by issuing echo 'Defaults !tty_tickets' >> /etc/sudoers.3 In order for this change to be reflected, the malware also issued killall Terminal. As of macOS Sierra, the sudoers file has tty_tickets enabled by default.

Item Value
ID T1548.003
Sub-techniques T1548.001, T1548.002, T1548.003, T1548.004
Tactics TA0004, TA0005
Platforms Linux, macOS
Permissions required User
Version 1.0
Created 30 January 2020
Last Modified 14 March 2022

Procedure Examples

ID Name Description
S0154 Cobalt Strike Cobalt Strike can use sudo to run a command.4
S0281 Dok Dok adds admin ALL=(ALL) NOPASSWD: ALL to the /etc/sudoers file.6
S0279 Proton Proton modifies the tty_tickets line in the sudoers file.5

Mitigations

ID Mitigation Description
M1028 Operating System Configuration Ensuring that the tty_tickets setting is enabled will prevent this leakage across tty sessions.
M1026 Privileged Account Management By requiring a password, even if an adversary can get terminal access, they must know the password to run anything in the sudoers file. Setting the timestamp_timeout to 0 will require the user to input their password every time sudo is executed.
M1022 Restrict File and Directory Permissions The sudoers file should be strictly edited such that passwords are always required and that users can’t spawn risky processes as users with higher privilege.

Detection

ID Data Source Data Component
DS0017 Command Command Execution
DS0022 File File Modification
DS0009 Process Process Creation

References

  1. Todd C. Miller. (2018). Sudo Man Page. Retrieved March 19, 2018. ↩

  2. Thomas Reed. (2017, July 7). New OSX.Dok malware intercepts web traffic. Retrieved July 10, 2017. ↩

  3. Amit Serper. (2018, May 10). ProtonB What this Mac Malware Actually Does. Retrieved March 19, 2018. ↩

  4. Strategic Cyber LLC. (2020, November 5). Cobalt Strike: Advanced Threat Tactics for Penetration Testers. Retrieved April 13, 2021. ↩

  5. Patrick Wardle. (n.d.). Mac Malware of 2017. Retrieved September 21, 2018. ↩

  6. fluffybunny. (2019, July 9). OSX.Dok Analysis. Retrieved October 4, 2021. ↩