sudo NOPASSWD Enumeration and Shell Escapes

sudo delegates privileged command execution to unprivileged users, and its configuration file (/etc/sudoers) is one of the richest privesc information sources on a Linux host. The single most useful enumeration command is:

sudo -l

which reports, for the current user:

• Permitted commands — the exact binaries the user may run as root (or another user), including whether a password is required. Entries tagged NOPASSWD: are the immediate wins: any listed binary with a known shell-escape (more, less, vim, awk, find, etc. — the GTFOBins catalog) is a direct root shell.
• Preserved environment variables — env_keep entries such as LD_PRELOAD or LD_LIBRARY_PATH, which enable the LD_PRELOAD/LD_LIBRARY_PATH injection attacks.
• Run-as specifications — (ALL) vs (root) vs a specific user, and host restrictions.

Caveats

• sudo -l itself requires some sudo privilege — a user with no sudoers entry gets Sorry, user X may not run sudo.
• The invocation is logged (to syslog / the audit subsystem), so it is visible to defenders. It is an enumeration step, not a stealthy one.

From listing to shell

The general workflow:

1. sudo -l → note NOPASSWD binaries and env_keep variables.
2. Look each binary up in GTFOBins for a sudo shell/file-read/file-write primitive.
3. If env_keep covers LD_PRELOAD/LD_LIBRARY_PATH, compile the shared-object payload from ld-preload-trick instead of relying on a built-in escape.
4. If the binary is systemctl, the service-file trick in systemctl-suid-privesc applies directly.

Related primitives reachable from a sudo -l finding include pager escapes (!/bin/bash inside more/less), editor escapes (vim’s :!sh), and interpreter escapes (awk 'BEGIN {system("/bin/bash")}').

Sources

• sudo(8) — execute a command as another user
• sudoers(5) — default sudo security policy plugin
• GTFOBins

Related: ld-preload-trick, more-pager-shell-escape, systemctl-suid-privesc, suid-shell-executable, unix-permissions