id: privesc-cdist info: name: Cdist - Privilege Escalation author: daffainfo severity: high description: | cdist is a free software configuration management tool for Unix-like systems. It manages nodes over SSH using the Bourne Shell, and does not require any additional software to be installed on target nodes. reference: - https://gtfobins.github.io/gtfobins/cdist/ metadata: verified: true tags: code,linux,cdist,privesc self-contained: true code: - engine: - sh - bash source: | whoami - engine: - sh - bash source: | cdist shell -s whoami - engine: - sh - bash source: | sudo cdist shell -s whoami matchers-condition: and matchers: - type: word part: code_1_response words: - "root" negative: true - type: dsl dsl: - 'contains(code_2_response, "root")' - 'contains(code_3_response, "root")' condition: or # digest: 4b0a00483046022100afe727ba45ca0c542cf2d85169a2be57d6e94550933ab38dcea2dc7a3bd9eb32022100e6d9677f8dc6af52f782bf0411ad39256b42baeae17ad41d2cb78f617de9a96c:922c64590222798bb761d5b6d8e72950