Sploitus

Exploit for Off-by-one Error in Sudo Project Sudo

gitee · 2021-03-14

Exploit Code

MARKDOWN12 lines
## https://sploitus.com/exploit?id=277350D7-3A37-510A-A8ED-4516FCE44CE2
This is a PoC exploit for CVE-2021-3156, a vulnerability in the GNU C Library (glibc) that allows for a buffer overflow attack. The exploit is written in C and is designed to work on Ubuntu 18.04 and 20.04 systems.

The exploit creates a malicious shared library, "libnss_X.so.2", that is designed to be loaded by the glibc when it attempts to resolve a username. The library contains a buffer overflow vulnerability that allows an attacker to execute arbitrary code on the system.

The exploit is triggered by running the "exploit" binary, which creates the malicious library and sets up the environment to allow the glibc to load it. The exploit then waits for the glibc to load the library and execute the malicious code.

The vulnerability in glibc is caused by a buffer overflow in the getpwuid function, which is used to retrieve information about a user from the /etc/passwd file. The function does not properly validate the length of the username, allowing an attacker to overflow the buffer and execute arbitrary code.

The exploit is designed to be used for testing and research purposes only, and should not be used in a production environment.

The exploit is typically invoked by running the "exploit" binary, which