Sudo group abuse

On Linux, group membership is not always cosmetic: the sudo group (on Debian/Ubuntu; wheel on RHEL/CentOS) is the one that the default /etc/sudoers authorizes to run any command as root. So the first thing to do after compromising a user is to check which groups they belong to:

id

If the output shows something like groups=...,27(sudo) (GID 27 is the sudo group on Debian), that user can become root with no more friction than knowing their own password, because the sudoers rule %sudo ALL=(ALL:ALL) ALL grants the privilege to the whole group.

The abuse is direct: ask for a root shell.

sudo su
sudo -i
sudo bash

Any of the three works; sudo su launches su (switch user to root) through sudo. The system asks for the current user's password, not root's, and then drops a # prompt. A following id confirms uid=0(root).

Why it happens. This is not a software bug but an administrative grant: someone added the account to sudo. In an audit, always check id and sudo -l (the latter lists what may be run and under what restrictions, including passwordless NOPASSWD). The difference is that sudo -l may reveal permissions scoped to specific binaries (which open the GTFOBins path), whereas membership in the sudo group with no restrictions is the master key.

How to detect it. Every sudo leaves a record in /var/log/auth.log (or journalctl _COMM=sudo) with the user, TTY, directory and COMMAND: a sudo su/sudo -i/sudo bash opening a root session is visible instantly, and on modern Linux it also generates a USER_CMD/CRED_ACQ auditd event. The abuse signal is not a one-off sudo (normal for an admin) but the pattern: a service account or one that shouldn't administer the system escalating to root, or access outside working hours. An auditd rule watching /etc/group and /etc/sudoers (-w /etc/group -p wa) reveals the exact moment sudo/wheel membership is granted.

Defence. Limit who is in sudo/wheel, require a password (don't overuse NOPASSWD), and scope sudoers rules to the strictly necessary commands instead of granting ALL.