CVE-2021-3156 PoC — Sudo 缓冲区错误漏洞

Source

https://github.com/DanielAzulayy/CTF-2021

Associated Vulnerability

Title:Sudo 缓冲区错误漏洞 (CVE-2021-3156)
Description:Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.

Description

CTF for HDE 64 students at See Security College. Exploit a JWT (web part) & CVE-2021-3156 (LPE part).

Readme

# CTF-2021

# Notes

This CTF is not using DB for authentication. In addition to that, this CTF generates static tokens
because of the following:

1. Minimize the chances of a user solving this CTF in a different way

2. Minimize the chances of a user missing hints by modifying or bypassing web pages/tokens.

3. Less traffic 

4. More reliability for users solving this CTF.


ubuntu 20.04 is recommended for the LPE part.
If you clone this, please delete this README.md file because it contains some hints.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!