Sudo pwfeedback stack-based buffer overflow

This repository contains a local privilege escalation exploit for CVE-2019-18634, a vulnerability in sudo (with pwfeedback enabled). The main file, 'exploit.py', is a Python script that leverages the vulnerability to execute a reverse shell as root. The script creates a bash reverse shell script at '/tmp/shell.sh', sets it as executable, and uses it as the SUDO_ASKPASS helper to gain root privileges. The exploit listens on localhost:4444 for the reverse shell connection. The repository is simple, with only a README and the exploit script. The exploit is operational and demonstrates a working privilege escalation attack, but is not weaponized for remote or automated targeting. No external network endpoints are used; all actions are local to the compromised system.

This repository contains a single C exploit (exploit.c) targeting CVE-2019-18634, a local privilege escalation vulnerability in sudo when the pwfeedback option is enabled. The exploit works by creating a pseudo-terminal, crafting a buffer overflow payload, and manipulating sudo's internal structures to escalate privileges and execute a shell as root. The exploit is operational and requires compilation and execution on a vulnerable Linux system. The Makefile provides a simple build process, and the README references the CVE and relevant advisories. The exploit does not target remote systems or network services; it is strictly a local privilege escalation tool. Notable fingerprintable endpoints include /proc/self/exe (used to set SUDO_ASKPASS) and /dev/tty (referenced in comments).

This repository demonstrates a local privilege escalation exploit for CVE-2019-18634, targeting sudo version 1.8.25 with the 'pwfeedback' option enabled. The structure includes a Dockerfile to build a vulnerable Ubuntu 20.04 environment, a custom sudoers file enabling the vulnerable option, and an exploit script (exploit.py) written in Python. The exploit works by crafting a buffer overflow payload that manipulates internal sudo structures, ultimately allowing the attacker to execute arbitrary commands as root. The develop.sh script automates the Docker build and assists in analyzing the vulnerable sudo binary. The exploit is a proof-of-concept and requires local access to the system with the specific vulnerable configuration. No network endpoints are involved; the attack vector is purely local. The repository is well-structured for educational and demonstration purposes.

This repository provides a functional local privilege escalation exploit for CVE-2019-18634, a heap buffer overflow in sudo (<=1.8.30) when 'pwfeedback' is enabled. The exploit consists of a self-contained Bash script ('self-contained.sh') that orchestrates the attack, as well as its component scripts in the 'src' directory: a C program ('exec.c') that creates a SUID root shell, a Perl script ('xpl.pl') that crafts the malicious input to trigger the overflow, and a Bash runner ('run.sh'). The exploit uses 'socat' to create a pseudo-terminal, sets up the environment to use the malicious binary as SUDO_ASKPASS, and then triggers sudo to execute the payload, resulting in a root shell. The exploit is operational and requires local access to the target system. Key fingerprintable endpoints include temporary files in /tmp, the use of /proc/self/exe, and the download of a static socat binary from GitHub.