CVE-2025-32463 PoC — Sudo 安全漏洞

Readme

# CVE-2025-32463 – Sudo chroot Local Privilege Escalation Lab

This repository contains a Docker-based lab and proof-of-concept exploit for [CVE-2025-32463](https://www.sudo.ws/security/advisories/chroot_bug), a local privilege escalation vulnerability in `sudo` (versions 1.9.14 to 1.9.17).

## 🚨 Disclaimer

This code is for educational and authorized testing purposes only. Do not use on systems you do not own or have explicit permission to test.

## Lab Features

- Vulnerable Ubuntu 24.04 container with `sudo` 1.9.15p5
- Non-privileged user (`labuser`)
- Exploit script: `sudo-chwoot.sh`
- Dockerfile for easy setup

## Quick Start

```bash
git clone https://github.com/adonijah01/cve-2025-32463-lab.git
cd cve-2025-32463-lab
docker build -t cve-2025-32463-lab .
docker run --rm -it --privileged cve-2025-32463-lab
```

Inside the container:

```bash
cd ~
./sudo-chwoot.sh
```

## Exploit Overview

The exploit abuses the `--chroot` option in sudo and a crafted `nsswitch.conf` to load a malicious NSS module, resulting in root shell access.

## Reference

- [Sudo Security Advisory](https://www.sudo.ws/security/advisories/chroot_bug)
- [CVE-2025-32463 in the CVE database](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-32463)
- [Stratascale Advisory](https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot) - Original research and PoC concept

## Credits

Exploit concept and vulnerability details referenced from the official Sudo advisory, CVE database, and [Stratascale's research](https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot).

Stay safe and use responsibly!

File Snapshot

Remarks