Holiday Hack Challenge 2025 Neighborhood Watch Bypass

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://0xdf.gitlab.io/holidayhack2025/act1/neighborhood-watch
• Blog Title: Holiday Hack Challenge 2025: Neighborhood Watch Bypass
• Suggested Section: Linux Privilege Escalation -> Sudo (sudoers misconfigs) -> PATH hijacking / env_keep+=PATH / insecure secure_path

🎯 Content Summary

What the challenge is asking

The objective is to execute /etc/firealarm/restore_fire_alarm from a restricted Linux shell obtained as user chiuser.

Initial enumeration (why the target can’t be run)

The user’s home directory includes a non-standard ~/bin directory and a symlink that appears to be the intended “shortcut” to the solution binary:

🏠 chiuser @ Dosis Neighborhood ~ 🔍 $ ls -la
total 24
drwxr-x--- 1 chiuser...
🔧 Technical Details
1) Sudo PATH preservation + command shadowing (PATH hijack): If sudoers is configured with env_keep+=PATH, the user’s PATH is inherited by a root-executed command. If that privileged command (often a script) invokes programs without absolute paths (e.g., free -h, df -h, w, ps aux | grep ... | head ...), an attacker can place a malicious executable/script with the same name as one invoked utility into a user-writable directory that appears earlier in PATH (e.g., ~/bin/free). When the privileged script runs, root resolves and executes the attacker’s trojan binary, yielding arbitrary root command execution.
2) Using the hijacked root execution to bypass access controls: Once you have root execution via PATH hijack, you can directly change filesystem permissions/ownership to access protected targets. Example: chmod 777 /etc/firealarm makes a previously root-only directory acces...
🤖 Agent Actions
Updated linux-hardening/privilege-escalation/README.md with a new subsection covering sudo env_keep+=PATH / insecure secure_path PATH hijacking, including abuse steps, persistence via SUID bash (bash -p), and mitigation guidance. Added the Holiday Hack 2025 Neighborhood Watch blog to references.

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://0xdf.gitlab.io/holidayhack2025/act1/neighborhood-watch

Content Categories: Based on the analysis, this content was categorized under "Linux Privilege Escalation -> Sudo (sudoers misconfigs) -> PATH hijacking / env_keep+=PATH / insecure secure_path".

Repository Maintenance:

• MD Files Formatting: 936 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0