linux on Rich Mirch

CVE-2025-32462, CVE-2025-32463 Sudo chroot, host Option Elevation of Privilege Vulnerabilities

Mon, 30 Jun 2025 00:00:00 +0000

I discovered two vulnerabilities in Sudo. Upgrade to Sudo 1.9.17p1 or later.

CVE-2025-32462 - Sudo Host Option Elevation of Privilege Vulnerability

CVE-2025-32462 has remained unnoticed for over 12 years, despite being present in the code all along. It relies on a specific yet common configuration where Sudo rules are restricted to certain hostnames or hostname patterns. If these conditions are met, privilege escalation to root requires no exploit.

Write-up: Sudo Host Option Elevation of Privilege
Advisories

CVE-2025-32463 - Sudo chroot Elevation of Privilege Vulnerability

CVE-2025-32463 The default Sudo configuration is vulnerable. Although the vulnerability involves the Sudo chroot feature, it does not require any Sudo rules to be defined for the user. As a result, any local unprivileged user could potentially escalate privileges to root if a vulnerable version is installed.

sudoedit symlink fix for CVE-2021-23240 introduced new vulnerability

Tue, 26 Jan 2021 02:43:51 +0000

I noticed the following changelog entry in sudo 1.9.5p1. This caught my attention so I decided to look further. I was unable to find an advisory, PoC, or CVE for this vulnerability. Using the details from the changelog message and fix, I decided to write an exploit for it.

Using an Ubuntu 20.04.1 VM, I created a low privileged user named “lowpriv” and added a sudoedit rule for a root owned file /etc/test.txt. I also downloaded the source for sudo 1.9.5, compiled it, and installed it to /opt/sudo.

CVE-2019-3466 Debian / Ubuntu Privilege Escalation via pg_ctlcluster

Fri, 15 Nov 2019 12:54:14 +0000

Vulnerability Summary

The pg_ctlcluster script in the postgresql-common package in Debian and Ubuntu is vulnerable to a local privilege escalation attack. pg_ctlcluster is a script used to manage PostgreSQL instances. A malicious actor with access to the postgres account can create arbitrary directories during startup or reload when called via systemd. This vulnerability can be leveraged to escalate privileges to root.

It’s important to note this is not a vulnerability in PostgreSQL and is specific to Debian, Ubuntu, or any system that consumes the Debian postgresql-common package.

CVE-2018-1792 - IBM MQ Privilege Escalation: Fun with RUNPATH

Sun, 25 Aug 2019 16:37:18 +0000

Vulnerability Summary

IBM MQ for Linux and UNIX systems is vulnerable to a privilege escalation attack by forcing a setuid root binary to load a malicious library. A local attacker with access to the mqm account can execute arbitrary code as root. In October 2018 IBM published an advisory along with patches for several versions.

The goal of this post is to show how the RPATH/RUNPATH value could potentially be leveraged for privilege escalation. When specified at compile time this path is embedded in the binary and is the first path searched when searching for a library if the dependent library specified does not contain a slash. Details on how this works can be found in the ld.so man page.

CVE-2019-6724 : Barracuda VPN Client Privilege Escalation on Linux and macOS

Thu, 14 Feb 2019 15:31:43 +0000

The barracudavpn component of the Barracuda VPN Client prior to version 5.0.2.7 for Linux, macOS, and OpenBSD runs as a privileged process and can allow an unprivileged local attacker to load a malicious library, resulting in arbitrary code executing as root.

This post will walk through the process on how I found and exploited the vulnerability on Linux. The full PoC will also work on macOS. When researching for potential vulnerabilities with privileged binaries a test system should be used to avoid causing damage or negative impacts.

Linux persistence idea - using group passwords

Wed, 09 Jan 2019 18:16:32 +0000

A rarely used feature on Linux and UNIX systems is the ability to add a password to a group. The concept is similar to how users are handled. An encrypted hash is stored in the second field of the gshadow(5) file. Anyone with the password can execute the newgrp(1) command to temporarily change their GID without having to be a member of the group. The goal of this post is to show how this feature can be leveraged to create persistence on a server in a semi stealthy way.

CVE-2018-18629: Keybase Linux privilege escalation

Fri, 21 Dec 2018 18:43:08 +0000

Recently I started using Keybase which is a Slack-like application but provides end-to-end encryption. Version 2.8.0.20181017144746.3efc4cbf3c is vulnerable to a privilege escalation vulnerability allowing a low privileged user to execute arbitrary commands as root.

After executing the application using a low privileged account I noticed a process named keybase-redirector running as root. I was interested and wanted to understand how this worked. After checking the file permissions I found that the keybase-redirector was setuid root. I enjoy the challenge of finding vulnerabilities in privileged binaries so I started my research.

CVE-2018-19788 PoC - polkit: Improper handling of user with uid > INT_MAX leading to authentication bypass

Sun, 09 Dec 2018 19:32:04 +0000

While reviewing my Twitter feed I noticed a recent popular tweet from @0xdea. https://twitter.com/0xdea/status/1070308598146850818 I was intrigued and wanted to see if there was a way to leverage this to execute arbitrary code as root.

First we need to understand what the value of INT_MAX is. Fortunately the getconf command can be used to find the value or you can find it in /usr/include/limits.h.

[root@localhost ~]# getconf INT_MAX
2147483647
[root@localhost ~]# grep 'define INT_MAX' /usr/include/limits.h
# define INT_MAX 2147483647

To exploit the vulnerability the user must have a UID value larger than 2147483647. I used the same value of 4000000000 that @0xdea posted.

CVE-2018-18556 - VyOS Privilege escalation via sudo pppd for operator users

Tue, 06 Nov 2018 04:39:42 +0000

Recently I found several ways to escape the restricted shell for an operator user in VyOS 1.1.8. VyOS is a Linux-based network operating system that provides software-based network routing, firewall, and VPN functionality. I plan to post information on the restricted shell escapes in the near future; For now read the blog by @dmbaturin detailing some of the methods.

This post will focus on how root access was obtained using sudo after the restricted shell was escaped. One of my first post exploitation steps on Linux after a low privileged shell is obtained is to check if the user has sudo rules configured. Sudo is designed to limit privileges but often it can be leveraged to elevate access.