# CVE-2025-32463 – Sudo chroot Local Privilege Escalation Lab
This repository contains a Docker-based lab and proof-of-concept exploit for [CVE-2025-32463](https://www.sudo.ws/security/advisories/chroot_bug), a local privilege escalation vulnerability in `sudo` (versions 1.9.14 to 1.9.17).
## 🚨 Disclaimer
This code is for educational and authorized testing purposes only. Do not use on systems you do not own or have explicit permission to test.
## Lab Features
- Vulnerable Ubuntu 24.04 container with `sudo` 1.9.15p5
- Non-privileged user (`labuser`)
- Exploit script: `sudo-chwoot.sh`
- Dockerfile for easy setup
## Quick Start
```bash
git clone https://github.com/adonijah01/cve-2025-32463-lab.git
cd cve-2025-32463-lab
docker build -t cve-2025-32463-lab .
docker run --rm -it --privileged cve-2025-32463-lab
```
Inside the container:
```bash
cd ~
./sudo-chwoot.sh
```
## Exploit Overview
The exploit abuses the `--chroot` option in sudo and a crafted `nsswitch.conf` to load a malicious NSS module, resulting in root shell access.
## Reference
- [Sudo Security Advisory](https://www.sudo.ws/security/advisories/chroot_bug)
- [CVE-2025-32463 in the CVE database](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-32463)
- [Stratascale Advisory](https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot) - Original research and PoC concept
## Credits
Exploit concept and vulnerability details referenced from the official Sudo advisory, CVE database, and [Stratascale's research](https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot).
Stay safe and use responsibly!
[4.0K] /data/pocs/95ea84ad902f46a05f754610490dd96f658ce493
├── [ 580] Dockerfile
├── [1.6K] README.md
└── [ 652] sudo-chwoot.sh
0 directories, 3 files