sudo

I discovered two vulnerabilities in Sudo. Upgrade to Sudo 1.9.17p1 or later. CVE-2025-32462 - Sudo Host Option Elevation of Privilege Vulnerability CVE-2025-32462 has remained unnoticed for over 12 years, despite being present in the code all along. It relies on a specific yet common configuration where Sudo rules are restricted to certain hostnames or hostname patterns. If these conditions are met, privilege escalation to root requires no exploit. Write-up: Sudo Host Option Elevation of Privilege Advisories Sudo: https://www.sudo.ws/security/advisories/host_any/ RedHat: https://access.redhat.com/security/cve/cve-2025-32462 Ubuntu: https://ubuntu.com/security/notices/USN-7604-1 Debian: https://lists.debian.org/debian-security-announce/2025/msg00118.html Amazon: https://explore.alas.aws.amazon.com/CVE-2025-32462.html Gentoo: https://bugs.gentoo.org/show_bug.cgi?id=CVE-2025-32462 CVE-2025-32463 - Sudo chroot Elevation of Privilege Vulnerability CVE-2025-32463 The default Sudo configuration is vulnerable. Although the vulnerability involves the Sudo chroot feature, it does not require any Sudo rules to be defined for the user. As a result, any local unprivileged user could potentially escalate privileges to root if a vulnerable version is installed. ...

I noticed the following changelog entry in sudo 1.9.5p1. This caught my attention so I decided to look further. I was unable to find an advisory, PoC, or CVE for this vulnerability. Using the details from the changelog message and fix, I decided to write an exploit for it. Using an Ubuntu 20.04.1 VM, I created a low privileged user named “lowpriv” and added a sudoedit rule for a root owned file /etc/test.txt. I also downloaded the source for sudo 1.9.5, compiled it, and installed it to /opt/sudo. ...

Today, a Metasploit module was merged for a vulnerability I found in 2018 with VyOS. This vulnerability was my first public InfoSec blog post. I appreciate bcoles for developing the exploit/linux/ssh/vyos_restricted_shell_privesc module. Read the Metasploit Wrapup for 9/25/2020. The full write-up can be found on this blog at CVE-2018-18556 – VyOS Privilege escalation via sudo pppd for operator users.

Recently I found several ways to escape the restricted shell for an operator user in VyOS 1.1.8. VyOS is a Linux-based network operating system that provides software-based network routing, firewall, and VPN functionality. I plan to post information on the restricted shell escapes in the near future; For now read the blog by @dmbaturin detailing some of the methods. This post will focus on how root access was obtained using sudo after the restricted shell was escaped. One of my first post exploitation steps on Linux after a low privileged shell is obtained is to check if the user has sudo rules configured. Sudo is designed to limit privileges but often it can be leveraged to elevate access.