Sudo sudoers host matching authorization bypass via --host

Repository purpose: a small container-based lab plus an automated local privilege escalation PoC for sudo vulnerabilities CVE-2025-32462 and CVE-2025-32463. Structure (actual files present): - Dockerfile: builds an Ubuntu 24.04 container and compiles/installs sudo 1.9.16p2 from source (downloaded from sudo.ws). Creates a non-root user `pwn` for testing. - README.md: explains both CVEs and provides manual lab steps. It includes example Docker networking/hostnames to demonstrate CVE-2025-32462 (host matching bypass using `sudo -h highpriv.test.local ...`) and outlines the CVE-2025-32463 technique (NSS injection via `sudo -R` chroot). - auto_cve_2025_32463.sh: the main exploit automation. It creates a temporary staging directory, writes a C shared-library payload, builds it as a fake NSS module (libnss_/cve_2025_32463.so.2), creates a minimal chroot tree with a crafted `etc/nsswitch.conf` that references the custom NSS service name, then triggers the vulnerability with `sudo -R cve_2025_32463 cve_2025_32463`. When sudo loads the NSS module, the constructor sets uid/gid to 0 and execs /bin/bash, yielding a root shell. Exploit capabilities: - Local EoP to root (CVE-2025-32463) by achieving arbitrary code execution as root during sudo initialization in a chroot, via attacker-controlled NSS configuration and library loading. - The repo also documents (but does not provide a dedicated script for) CVE-2025-32462 exploitation: bypassing sudoers Host_Alias restrictions by supplying a spoofed hostname with `-h`, enabling unauthorized root command execution when host-based rules are in use. Notes on completeness: README describes additional directories (exploit/, lab/) that are not present in the provided file listing; the functional PoC in this archive is the single script auto_cve_2025_32463.sh plus the Docker lab build.

Repository contains a single Bash proof-of-concept exploit script plus README and MIT license. - Primary exploit file: `CVE-2025-32462.sh` (Bash, ~379 bytes). It is a local privilege escalation PoC that attempts to exploit CVE-2025-32462 by invoking `sudo -h <local_hostname> <cmd>` (default cmd: `id`). It suppresses stderr and checks stdout for `uid=0(root)` to determine success. On success, it launches an interactive root shell using `sudo -h <hostname> /bin/bash -p`. - README: documents the claimed affected sudo versions (<= 1.9.17), an example sudoers misconfiguration, usage examples, and mitigation guidance (upgrade to 1.9.17p1+; restrict -h/--host). No network exploitation is present; the only external URLs are README badge/reference links. The exploit’s capability is limited to local root shell acquisition under specific sudo/sudoers conditions.

This repository contains a Bash exploit script (exploit.sh) and a README.md for CVE-2025-32462, a privilege escalation vulnerability in sudo on Linux. The exploit targets systems where sudo's '-h' (host) option is permitted with NOPASSWD rights, allowing a user to bypass host restrictions and execute commands as root on a specified host alias (TARGET_HOST). The script provides a pseudo-root shell by reading user commands and executing them as root via 'sudo -h <host> -- bash -c <cmd>'. For a full interactive shell, the user is advised to run 'bash' or use 'vim' to break into a real TTY shell. The repository is simple, with one exploit script and a README, and is intended for educational or CTF use. No network endpoints or external IPs are hardcoded; the main fingerprintable element is the TARGET_HOST variable, which must be set to a valid host alias configured in sudoers.

This repository provides a Docker-based lab and proof-of-concept (PoC) exploits for two sudo vulnerabilities: CVE-2025-32462 (host matching logic bypass) and CVE-2025-32463 (chroot NSS library escape). The structure includes a Dockerfile for setting up a vulnerable Ubuntu 24.04 environment with sudo 1.9.16p2, a README.md with detailed exploitation steps, and an automated bash script (auto_cve_2025_32463.sh) to exploit CVE-2025-32463. The exploit for CVE-2025-32463 works by creating a malicious NSS shared library that, when loaded in a chrooted environment via sudo's -R option, escalates privileges and spawns a root shell. The PoC is operational in a controlled lab environment and demonstrates local privilege escalation. No network endpoints are targeted; all actions are local to the container. The repository is intended for educational and research purposes.

This repository contains a proof-of-concept (PoC) exploit for CVE-2025-32462, a local privilege escalation vulnerability in sudo (versions <= 1.9.17). The exploit is implemented as a single Bash script (CVE-2025-32462.sh) that attempts to leverage a logic flaw in sudo's -h/--host argument handling. If the target system is running a vulnerable version of sudo and is misconfigured (e.g., with a sudoers rule like '(ALL, !root) NOPASSWD: ALL'), the script can spawn a root shell by running 'sudo -h localhost /bin/bash -p'. The repository also includes a README.md with detailed usage instructions, requirements, mitigation advice, and references, as well as a LICENSE file. No network endpoints or remote attack vectors are present; the exploit is purely local and targets misconfigurations in sudo's local privilege management.

This repository contains a single C file, 'Exploit.c', which implements a proof-of-concept (PoC) exploit for CVE-2025-32462, a vulnerability in the 'sudo' utility's '-h' option. The exploit is interactive: it prompts the user for a target host and a command to execute as root. It then constructs and runs a 'sudo -h <targetHost> <command>' command, attempting to exploit the vulnerability to execute the specified command with root privileges. The exploit is local, requiring the attacker to have access to a system with a vulnerable version of 'sudo'. No network endpoints or remote services are directly targeted; the only fingerprintable endpoint is the 'sudo' binary itself. The code is straightforward and serves as a PoC, not a weaponized exploit.

This repository contains a proof-of-concept (PoC) exploit for CVE-2025-32462, a local privilege escalation vulnerability in sudo (versions < 1.9.17) related to hostname-based restrictions. The exploit is implemented as a Bash script ('matrix-sudo-escape.sh') and is accompanied by a detailed README.md. The script interactively demonstrates the vulnerability by: 1. Checking if the system is vulnerable (sudo version < 1.9.17). 2. Creating a demo user ('trinity') and setting a password. 3. Temporarily changing the system hostname to a whitelisted value and configuring sudoers to allow the demo user sudo access only from that hostname. 4. Switching to a restricted hostname and confirming the user cannot use sudo. 5. Exploiting the vulnerability by using 'sudo -h <whitelisted_hostname>' to bypass the hostname restriction and gain root access. 6. Optionally cleaning up by restoring the original hostname, removing the user, and restoring the sudoers file. The exploit requires local access and is intended for demonstration and educational purposes. The only code file is the Bash script, which automates the setup, exploitation, and cleanup processes. The main fingerprintable endpoints are the '/etc/sudoers' file (modified and restored) and the use of hostnames ('zion-core', 'matrix-node') in the sudoers configuration. No network endpoints are involved; the attack vector is purely local.