Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2021-3156 PoC — Sudo 缓冲区错误漏洞

Source
https://github.com/wurwur/CVE-2021-3156
Associated Vulnerability
Title:Sudo 缓冲区错误漏洞 (CVE-2021-3156)
Description:Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.
Description
Forked from @worawit, shorter&optimized. Only works for sudo=1.8.23 on Centos7
Readme
# exploit.py 
Forked from @worawit, shorter&optimized. Only works for sudo=1.8.23 on Centos7
Works on both the web server and linux machines

# backdoor.php
php backdoor generated through weevely, password: "H@rmW#sH4rE!". Gives access to an ssh session as Apache if sucessfully uploaded to the server

# shell.php%00.jpg
Null-Byte php file sanitization bypass
File Snapshot

 [4.0K]  /data/pocs/8da1c720cf12f5fce71014df83ddf1061da78337
├── [ 754]  backdoor.php
├── [9.6K]  exploit.py
├── [ 361]  README.md
└── [  32]  shell.php%00.jpg

0 directories, 4 files
Shenlong Bot has cached this for you
Remarks
    1. It is advised to access via the original source first.
    2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.
    3. Mirroring, verifying, and maintaining this POC archive takes ongoing effort, so local snapshots are a paid feature. Your subscription keeps the archive online — thank you for the support. View subscription plans →