Local privilege escalation in sudo get_process_ttyname() on Linux

This repository contains a single C source file, 'sudopwn.c', which implements a local privilege escalation exploit targeting the 'sudo' binary on Linux systems. The exploit works by creating a temporary directory in /dev/shm, setting up symlinks to /usr/bin/sudo and a pseudo-terminal device, and monitoring file events using inotify. It manipulates process priorities and scheduling, and attempts to execute sudo with crafted arguments, possibly exploiting a race condition or symlink vulnerability. The code is a proof-of-concept and requires local access to the target system. The main endpoints involved are file paths in /dev/shm, /usr/bin/sudo, /dev/pts/57, and /etc/PWN. The exploit does not target a specific CVE but is clearly designed to manipulate sudo's behavior for privilege escalation.

This repository contains a proof-of-concept exploit for CVE-2017-1000367, a vulnerability in sudo's SELinux support on Linux systems. The exploit is implemented in C (sudopwn.c) and is accompanied by a README.md with compilation and usage instructions. The exploit works by creating a temporary directory in /dev/shm/_tmp, setting up symlinks to /dev/pts/57, /usr/bin/sudo, and later /etc/motd, and then executing sudo with a specific SELinux role override to run /usr/bin/sum. The exploit leverages inotify to monitor file events and attempts to exploit a race condition in sudo's handling of SELinux roles. The attack is local and requires the user to have sudo permissions for a specific command. The repository is a single-file proof-of-concept and does not include weaponized or framework-based code.