T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:110- Finding
Predictable Administrative Credentials with Unrestricted Passwordless Sudo
- Content
View full analysis
@ # Create admin user sudo useradd -m -s /bin/bash -G sudo,docker admin echo 'admin:password' | sudo chpasswd sudo bash -c "echo 'admin ALL=(ALL) NOPASSWD:ALL' > /etc/sudoers.d/admin" ``` The same unsafe pattern is provided for both local and CI-built images: ```bash sudo useradd -m -s /bin/bash -G sudo,docker echo ':password' | sudo chpasswd sudo bash -c "echo ' ALL=(ALL) NOPASSWD:ALL' > /etc/sudoers.d/" sudo useradd -m -s /bin/bash -G sudo,docker admin echo 'admin:password' | sudo chpasswd sudo bash -c "echo 'admin ALL=(ALL) NOPASSWD:ALL' > /etc/sudoers.d/admin" ``` ### Technical Analysis The documented procedure creates an SSH-capable administrative account with the predictable password `password`. It then grants that account unrestricted passwordless sudo through an `ALL=(ALL) NOPASSWD:ALL` rule. This configuration violates least privilege and converts disclosure or guessing of the account password directly into root-level access. Membership in the `docker` group provides an additional root-equivalent privilege path because the account can ask the Docker daemon to start privileged containers or mount host filesystems. Although the environment is described as a virtual testbed, the management network and DUT remain reachable system components. The documentation does not require SSH key authentication, firewall restrictions, password rotation, or disabling password-based login. ### Attack Path 1. An attacker obtains network connectivity to the DUT management address, such as through the host, testbed management bridge, another testbed container, or an exposed management route. 2. The attacker identifies the doc ...[truncated 929 chars]- Remediation
View remediation