CVE-2019-14287 PoC — Sudo 输入验证错误漏洞

Source

https://github.com/CMNatic/Dockerized-CVE-2019-14287

Associated Vulnerability

Title:Sudo 输入验证错误漏洞 (CVE-2019-14287)
Description:In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u \#$((0xffffffff))" command.

Description

Containerized and deployable use of the CVE-2019-14287 vuln. View README.md for more.

Readme

# Dockerized CVE-2019-14287
 Containerized and deployable use of the [**CVE-2019-14287**](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14287) vuln. View README.md for more.

This CVE affects all versions of **sudo under 1.8.28** where a sudo user can escalate to root by referencing its user ID.


This Dockerfile allows this CVE to be built, where it can be used for CTF's and demonstrations for example.

Shoutout to [MuirlandOracle](https://muirlandoracle.co.uk/) for reaching out to me for help regarding dockerising this CVE. MurilandOracle has released a room on [TryHackMe](https://tryhackme.com/room/sudovulns) where this CVE is exploited and explained - he does an excellent job of explaining how it works.

I highly reccommend you check out the room specifically - but moreover the [TryHackMe](https://tryhackme.com) platform itself.

~ [CMNatic](https://cmnatic.co.uk)

## To build:

Either clone repo, or download contents of "Dockerfile" to local machine:

`` git clone https://github.com/CMNatic/Dockerized-CVE-2019-14287/ ``

### or simply pull from the Docker Hub
as it uses an SSH server, port 22 is exposed - please feel free to address this port to any port that is not in use on your host.

1.  `docker run -d -p 2222:22 cmnatic/cve-2019-14287-demo `

Login to container:

Using default credentials:
  Username: uogctf
  Password: uogctf

   1. `ssh -l uogctf 127.0.0.1 -p 2222`

Then attempt the CVE.

for reference, **root** user is available to login using **uogctf**


## [MITRE - CVE-2019-14287](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14287)


## [MuirlandOracle's THM Room](https://tryhackme.com/room/sudovulns)

## [DockerHub Entry](https://hub.docker.com/r/cmnatic/cve-2019-14287-demo)

File Snapshot


 [4.0K]  /data/pocs/81e870188f4752f65c37ede3ef2609259fb5f95f
├── [1.1K]  Dockerfile
└── [1.7K]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!