dosbox SUID abuse

DOSBox is an MS-DOS emulator meant for running old games and programs. Among its abilities are mounting host directories as DOS drives and writing files to them. That harmless feature turns into an escalation when the binary carries the SUID bit owned by root: anything DOSBox writes is written as root.

SUID reminder. A SUID binary runs with its owner's privileges, not the launcher's. If /usr/bin/dosbox is owned by root and SUID, any write the emulator performs happens with root authority. It's part of SUID binary abuse and is catalogued in GTFOBins. Located with:

find / -perm -4000 2>/dev/null

The abuse (GTFOBins style). DOSBox lets you pass commands with -c. We mount the system root as drive C: and, by redirecting output, write to a sensitive file as root. In Nukem the target was /etc/sudoers, to grant ourselves full sudo:

LFILE='/etc/sudoers'
dosbox -c 'mount c /' -c "echo commander ALL=(ALL:ALL) ALL >> C:$LFILE" -c exit

After that, the user can sudo anything:

sudo -l
sudo su

User commander may run the following commands on nukem:
    (ALL : ALL) ALL

(Another variant writes a line into /etc/passwd with a root user of known password, then sus to it.)

The Nukem twist: DOSBox needs a display. DOSBox is a graphical app and won't start without an X server. The box exposed a VNC on 127.0.0.1:5901 (visible with netstat -tuln, localhost only). The fix was an SSH tunnel and a VNC client to get a desktop where the emulator could run:

ssh -L 5901:localhost:5901 commander@<ip>
vncviewer 127.0.0.1:5901

From the graphical terminal in that VNC session you run the SUID dosbox and complete the write. It's a good reminder that a privesc technique sometimes requires first solving an environment prerequisite (here, a graphical display via port forwarding).

How to detect it. The direct signature is dosbox writing to a sensitive file as root: auditd -w /etc/sudoers -p wa and -w /etc/passwd -p wa with the dosbox process as the author of the change is unmistakable (a DOS emulator has no business touching sudoers). At rest, dosbox with the SUID bit in find / -perm -4000 is already the deviation. A new line in /etc/sudoers//etc/passwd (FIM) or a sudo freshly granted to an account that didn't have it closes the chain; the prior VNC/SSH tunnel (a session forwarding 5901) is the network hint.

Defence. Remove the SUID bit from dosbox (and from any emulator or tool able to mount and write files): there is no legitimate reason for a DOS emulator to run as root. Audit the inventory with find / -perm -4000 and strip the bit from anything that doesn't need it.