cve-2025-32463-lab

CVE-2025-32463 – Sudo chroot Local Privilege Escalation Lab This repository contains a Docker-based lab and proof-of-concept exploit for CVE-2025-32463, a local privilege escalation vulnerability in sudo versions 1.9.14 to 1.9.17. 🚨 Disclaimer This code is for educational and authorized testing...

CVE-2025-32463-POC

CVE-2025-32463 - sudo Local Privilege Escalation PoC ⚠️ This repository contains a Proof of Concept PoC exploit for CVE-2025-32463 Intended only for educational purposes and use in authorized environments. 🧠 About the Vulnerability CVE-2025-32463 is a local privilege escalation vulnerability...

CVE-2025-32463_Sudo_PoC

CVE-2025-32463SudoPoC PoC for CVE-2025-32463: Local privilege escalation in sudo via --chroot. Exploits NSS module injection through crafted chroot environments. Designed for security researchers and lab-only environments. CVE-2025-32463 - Local Privilege Escalation via sudo --chroot A Python-bas...

CVE-2025-32463

📌 CVE-2025-32463 — Sudo --chroot Local Privilege Escalation ExploitDB ID: 52352 🧠 Overview This repository documents a critical local privilege escalation LPE vulnerability affecting Sudo versions 1.9.14 – 1.9.17. The vulnerability arises from an incorrect implementation of the sudo -R --chroot...

sudoinjection

CVE-2025-32463: Local Privilege Escalation via sudo -R NSS Injection Summary This PoC demonstrates local privilege escalation on Linux systems via abuse of the sudo -R option in conjunction with a custom NSS module. It targets the vulnerability CVE-2025-32463, which stems from unsafe handling of...

CVE-2025-32462_32463-Lab

CVE-2025-32462 & CVE-2025-32463 – PoC Lab This is a container-based lab and PoC for the following vulnerabilities in sudo: CVE-2025-32462 – sudo -h host matching logic bypass CVE-2025-32463 – sudo -R chroot NSS library escape 🔒 For educational purposes only. Do not use on systems you don’t own or...

CVE-2025-32463-PoC

CVE-2025-32463 – Privilege Escalation via Sudo chroot 📝 Overview CVE-2025-32463 is a local privilege escalation vulnerability affecting the sudo utility. It allows a regular user to escalate privileges to root by exploiting the -R option which sets a custom runtime root directory together with...

CVE-2025-32463_sudo_chroot

CVE-2025-32463 - sudo chroot Usage The Dockerfile creates a safe, isolated testing environment with a vulnerable version of sudo 1.9.16p2 installed. This allows you to test the exploit without affecting your host system. Build the vulnerable test environment docker build -t cve . Run the containe...

cve-2025-32463

cve-2025-32463 chroot sudo chroot Execute the command in the selected dir name. Principle This issue was introduced in sudo v1.9.14, which upgraded the matching handling code when the chroot feature is used. This new change modifies the root directory id before matching execution of the chroot...

CVE-2025-32463-POC

CVE-2025-32463 – Sudo chroot Privilege Escalation PoC This repository contains a proof-of-concept PoC exploit for CVE-2025-32463, a local privilege escalation vulnerability in sudo versions 1.9.14 through 1.9.17. The vulnerability allows a local unprivileged user to escalate privileges to root by...

CVE-2025-32463-EXPLOIT

Xpl0it — Sudo NSS Library Hijack | v0.0.4 Author: 0xb0rn3 | 0xbv1 Type: Proof of Concept PoC Security Research Tool CVE: CVE-2023-42456 Technique: sudo -R chroot NSS library injection → privilege escalation to root ⚠️ Disclaimer This tool is developed for authorized penetration testing and...

CVE-2025-32462-CVE-2025-32463-PoC-Lab

CVE-2025-32462 & CVE-2025-32463 – Advanced PoC Lab This repository provides a container-based lab and detailed PoC for two critical sudo vulnerabilities: CVE-2025-32462 – sudo -h host matching logic bypass CVE-2025-32463 – sudo -R chroot NSS library escape Research & Credit Original research by...

libreswan: Denial of Service via sending bogus X.509 certificates

A flaw was found in Libreswan's handling of malformed X.509 certificates when running in FIPS mode. A remote attacker may cause a rejected certificate to remain in the NSS certificate cache, resulting in legitimate certificates with the same serial number being rejected. This can prevent affected...

CVE-2021-3156

CVE-2021-3156 Sudo Baron Samedit This repository is CVE-2021-3156 exploit targeting Linux x64. For writeup, please visit https://datafarm-cybersecurity.medium.com/exploit-writeup-for-cve-2021-3156-sudo-baron-samedit-7a9a4282cb31 Credit to Braon Samedit of Qualys for the original advisory. Files...

CVE-2025-32463_illdeed

CVE-2025-32463 — sudo -R Privilege Escalation Exploit illdeed Variant This is a refactored proof-of-concept PoC exploit for CVE-2025-32463, a critical vulnerability in sudo versions 1.9.14 through 1.9.17 that allows local privilege escalation to root via sudo -R and a fake NSS module. ⚠️ This...

CVE-2025-32463

CVE-2025-32463 Is a local privilege escalation vulnerability affecting vulnerable versions of sudo. The flaw abuses the sudo -R chroot feature together with the Linux Name Service Switch NSS mechanism to force sudo into loading an attacker-controlled shared library as root. By manipulating...

CVE-2025-32463_POC

Checking nsswitch.conf default values: passwd: files systemd After calling chroot, sudo trys to parse the config values at nsswitch.conf to run the command, which leads it to try to open libnsssystemd.so.2...

CVE-2025-32463_exploit

CVE-2025-32463 — sudo "chwoot" chroot Local Privilege Escalation Local privilege escalation to root in sudo via the --chroot -R option. Works for any local user , including accounts with no sudoers entry at all e.g. www-data. sudo 1.9.14 – 1.9.17 chroots into the user-supplied directory while the...

CVE-2025-32463_Exploit

CVE-2025-32463Exploit Affected versions 1.9.14 to 1.9.17 bash run.sh Success as follows neko@aosc-neko205 CVE-2025-32463Exploit@main $ bash run.sh + CVE-2025-32463 Sudo chroot 漏洞复现脚本 正在创建临时工作目录... 工作目录已创建: /tmp/sudoexploit.nc0EjT 正在创建 C 语言 payload woot1337.c... 正在设置 chroot 环境和恶意的 nsswitch.conf...

CIFSwitch

CIFSwitch CVE-2026-46243 Writeup !WARNING The PoC is provided solely to help defenders, maintainers, and authorized security teams validate patches, mitigations, detections, and exposure on systems they own or are explicitly authorized to test. You are solely responsible for ensuring that your us...