GTFO, Root: A Practical Sudo Audit Script for GTFOBins Escapes

Originally published on Medium -- GitHub Repository

Overview

GTFO-Auditor turns sudoers review into a repeatable privilege-escalation triage workflow. It maps allowed commands to GTFOBins primitives, flags high-risk rule modifiers, and gives reviewers a concrete shortlist instead of forcing manual lookup for every binary.

Threat Model

Attacker position	Local shell as a non-root user
Input	Effective sudo rules or a sudoers file collected during assessment
Risk	Rules that let a user cross a privilege boundary through an allowed binary
Output	Candidate escalation paths requiring human confirmation

What It Checks

• Sudo-allowed binaries with known GTFOBins shell, file-write, file-read, sudo, or SUID primitives.
• NOPASSWD rules that remove the last interactive barrier.
• Wildcard command specifications where attacker-controlled path or argument expansion can change the executed target.
• NOEXEC assumptions that are weak for interpreters, loaders, and binaries with alternate execution paths.
• Environment-preserving rules that may expose loader, pager, editor, or language-runtime injection.

Usage

git clone https://github.com/JohannesLks/gtfo-auditor.git
cd gtfo-auditor
python3 gtfo-auditor.py

# Review an exported sudoers file
python3 gtfo-auditor.py --sudoers ./sudoers.txt

Example Finding

Rule:
  user ALL=(root) NOPASSWD: /usr/bin/vim

Finding:
  /usr/bin/vim has GTFOBins sudo primitives.
  NOPASSWD removes the authentication prompt.

Manual validation:
  sudo vim -c ':set shell=/bin/sh' -c ':shell'

Limitations

The tool is a triage aid, not a proof engine. Sudoers semantics, command aliases, per-host rules, AppArmor/SELinux confinement, mount flags, and application-specific hardening can invalidate a candidate path. Treat output as "verify this first" rather than "root guaranteed."