Privilege escalation exploit for CVE-2025-32463 using a malicious NSS module injected via sudo -R. This version creates a stealth payload called illdeed, granting root access through a controlled chroot environment.# CVE-2025-32463 — sudo -R Privilege Escalation Exploit (illdeed Variant)
This is a refactored proof-of-concept (PoC) exploit for [CVE-2025-32463](https://nvd.nist.gov/vuln/detail/CVE-2025-32463), a critical vulnerability in `sudo` versions 1.9.14 through 1.9.17 that allows **local privilege escalation to root** via `sudo -R` and a fake NSS module.
> ⚠️ This version creates a payload named `illdeed` for tracking and forensic testing.
## 💥 How It Works
- Creates a fake chroot directory with a custom `nsswitch.conf`
- Compiles a malicious `libnss_illdeed.so.2` shared object
- Executes arbitrary root commands using `sudo -R <fake_root>`
- Cleans up after execution unless `--no-clean` is passed
## ✅ Requirements
- Linux system with `sudo` 1.9.14 → 1.9.17
- `gcc` installed
- User with local shell access and ability to run `sudo -R` (no password required)
## 🚀 Usage
```bash
# Get an interactive root shell
./sudo-illdeed.sh
# Run a custom root command
./sudo-illdeed.sh "id && whoami && touch /root/illdeed.txt"
# Keep generated files for analysis
./sudo-illdeed.sh --no-clean
```
## 🔐 Disclaimer
This code is provided for educational and authorized security testing purposes only.
Do not use against systems you do not own or have explicit permission to test.
## 📚 Credits
Original PoC: Rich Mirch (Stratascale Cyber Research Unit)
Refactored variant: illdeed
登录后查看神龙缓存的 POC 文件快照
登录查看