POC详情： 87259980fe19494b775161086031c69665e76ac5

来源
https://github.com/shallvhack/Sudo-Security-Bypass-CVE-2019-14287
关联漏洞
标题： Sudo 输入验证错误漏洞 (CVE-2019-14287)
描述：Sudo是一款使用于类Unix系统的，允许用户通过安全的方式使用特殊的权限执行命令的程序。 sudo 1.8.28之前版本中存在安全漏洞。攻击者可利用该漏洞以root权限运行命令。
描述
Sudo Security Bypass (CVE-2019-14287)
介绍
# Sudo-Security-Bypass-CVE-2019-14287
===========================================================================

		 ██████╗██╗   ██╗███████╗    ██████╗  ██████╗  ██╗ █████╗        ██╗██╗  ██╗██████╗  █████╗ ███████╗
		██╔════╝██║   ██║██╔════╝    ╚════██╗██╔═████╗███║██╔══██╗      ███║██║  ██║╚════██╗██╔══██╗╚════██║
		██║     ██║   ██║█████╗█████╗ █████╔╝██║██╔██║╚██║╚██████║█████╗╚██║███████║ █████╔╝╚█████╔╝    ██╔╝
		██║     ╚██╗ ██╔╝██╔══╝╚════╝██╔═══╝ ████╔╝██║ ██║ ╚═══██║╚════╝ ██║╚════██║██╔═══╝ ██╔══██╗   ██╔╝
		╚██████╗ ╚████╔╝ ███████╗    ███████╗╚██████╔╝ ██║ █████╔╝       ██║     ██║███████╗╚█████╔╝   ██║
		 ╚═════╝  ╚═══╝  ╚══════╝    ╚══════╝ ╚═════╝  ╚═╝ ╚════╝        ╚═╝     ╚═╝╚══════╝ ╚════╝    ╚═╝

                                    
                                      
                                     Sudo Security Bypass Test

                        ========= By Vivek Yadav (www.shallvhack.com)=========
=============================================================================

<p align="center">
  <p align="center">
      <a href="https://www.gnu.org/software/bash/"><img alt="language" src="https://img.shields.io/badge/Lang-Bash%204.2+-blue.svg"></a>
      <a href="https://twitter.com/intent/follow?screen_name=shallvhack"><img alt="language" src="https://img.shields.io/twitter/follow/shallvhack?label=Follow%20%20ShallVhack&style=social"></a>
    </p>
</p>

# Vulnerability Description
In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u \#$((0xffffffff))" command.

# Script Description
This is a simple Proof of concept to test for recently disclosed Sudo Security Bypass vulnerability known as CVE-2019-14287.

# Recommendation
The best suggession for now would be to update the sudo to the version 1.8.28 or above.


# Contact me on:
Website: www.shallvhack.com

Twitter : www.twitter.com/shallvhack

Facebook : www.facebook.com/shallvhack

Github : https://github.com/shallvhack

LinkedIn : https://in.linkedin.com/in/vyvivekyadav04
文件快照

 [4.0K]  /data/pocs/87259980fe19494b775161086031c69665e76ac5
├── [1.0K]  LICENSE
├── [3.1K]  README.md
└── [3.0K]  SudoSecurityBypass.sh

0 directories, 3 files
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。