CVE-2019-18634 PoC — Sudo 缓冲区错误漏洞

Description

My n-day exploit for CVE-2019-18634 (local privilege escalation)

介绍

## CVE-2019-18634 N-Day Exploit

<img src="/.meta/cover.png">

## Slides

https://docs.google.com/presentation/d/11DpUy9Ll_HeuPRSgzaTARHPwlq01v_yyqbnJURlG9Ss/edit?usp=sharing

## Requirements

* Ubuntu 20.04
* sudo 1.8.25 (see below for how to build it manually)
* Python3
* [pwntools](https://github.com/Gallopsled/pwntools#installation)

## Enable pwfeedback

```
sudo visudo
```

Change this line

```
Defaults env_reset
```

To this

```
Defaults env_reset,pwfeedback
```

## Checkout sudo 1.8.25

```
git clone https://github.com/sudo-project/sudo
cd sudo
git fetch --all --tags
git checkout SUDO_1_8_25
```
## Install Pwntools

```
sudo apt-get update
sudo apt-get install python3 python3-pip python3-dev git libssl-dev libffi-dev build-essential
sudo python3 -m pip install --upgrade pip
sudo python3 -m pip install --upgrade pwntools
```

## Configure and Build

```
./configure --prefix=/usr/local
make
sudo make install
```

## Clone this repo and Run

```
git clone https://github.com/aesophor/CVE-2019-18634
cd CVE-2019-18634
./exploit.py
```

文件快照

备注