Exploit for Off-by-one Error in Sudo Project Sudo

## https://sploitus.com/exploit?id=5AF99452-0953-51CE-BEF7-AC6F6ACF44AC
# CVE-2021-3156 — Baron Samedit
## Heap-Based Buffer Overflow in sudo → Local Privilege Escalation
### ITSOLERA Cybersecurity Department | Red Team Internship 2026

---

```
  ██████╗  █████╗ ██████╗  ██████╗ ███╗   ██╗    ███████╗ █████╗ ███╗   ███╗███████╗██████╗ ██╗████████╗
  ██╔══██╗██╔══██╗██╔══██╗██╔═══██╗████╗  ██║    ██╔════╝██╔══██╗████╗ ████║██╔════╝██╔══██╗██║╚══██╔══╝
  ██████╔╝███████║██████╔╝██║   ██║██╔██╗ ██║    ███████╗███████║██╔████╔██║█████╗  ██║  ██║██║   ██║
  ██╔══██╗██╔══██║██╔══██╗██║   ██║██║╚██╗██║    ╚════██║██╔══██║██║╚██╔╝██║██╔══╝  ██║  ██║██║   ██║
  ██████╔╝██║  ██║██║  ██║╚██████╔╝██║ ╚████║    ███████║██║  ██║██║ ╚═╝ ██║███████╗██████╔╝██║   ██║
  ╚═════╝ ╚═╝  ╚═╝╚═╝  ╚═╝ ╚═════╝ ╚═╝  ╚═══╝    ╚══════╝╚═╝  ╚═╝╚═╝     ╚═╝╚══════╝╚═════╝ ╚═╝   ╚═╝
```

> ⚠️ **FOR EDUCATIONAL / ISOLATED LAB USE ONLY**
> All testing must be performed exclusively inside the Docker lab container.
> Never run against real, production, or shared systems.

---

## Table of Contents

1. [CVE Overview](#cve-overview)
2. [What Makes This CVE Special](#what-makes-this-cve-special)
3. [Project Structure](#project-structure)
4. [Team Deliverables](#team-deliverables)
5. [Quick Start](#quick-start)
6. [How the Exploit Works](#how-the-exploit-works)
7. [Vulnerability Canary Test](#vulnerability-canary-test)
8. [exploit.py Usage](#exploitpy-usage)
9. [Lab Reset & Snapshot](#lab-reset--snapshot)
10. [Patched vs Vulnerable Comparison](#patched-vs-vulnerable-comparison)
11. [References](#references)

---

## CVE Overview

| Property | Value |
|---|---|
| **CVE ID** | CVE-2021-3156 |
| **Nickname** | Baron Samedit |
| **Type** | Heap-Based Buffer Overflow → Local Privilege Escalation |
| **Component** | `sudo` — Linux privilege utility (`set_cmnd()` in `src/sudo.c`) |
| **CVSS v3 Score** | **7.8 High** |
| **Vector** | `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H` |
| **Vulnerable Versions** | sudo 1.8.2 – 1.8.31p2 and 1.9.0 – 1.9.5p1 |
| **Patched Versions** | sudo **1.9.5p2** (1.9 branch) / sudo **1.8.32** (1.8 branch) |
| **Lab Target Version** | sudo 1.8.31 on Ubuntu 20.04 |
| **Patch KB / Advisory** | SA: https://www.sudo.ws/security/advisories/unescape_overflow/ |
| **Discovered By** | Qualys Research Team |
| **Disclosed** | 2021-01-26 |
| **In Wild Since (code)** | ~2011-07-09 (sudo 1.8.2) — **~10 years undetected** |
| **Auth Required** | Local user only — **NO sudo permissions needed** |

---

## What Makes This CVE Special

| Property | CVE-2021-3156 | Typical Sudo LPE |
|---|---|---|
| Requires sudoers entry | ❌ **No** | ✅ Yes |
| Requires sudo group membership | ❌ **No** | ✅ Yes |
| Requires any prior sudo access | ❌ **No** | ✅ Yes |
| Works from brand-new user account | ✅ **Yes** | ❌ No |
| Exploits permission system | ❌ Bypasses entirely | ✅ Abuses it |
| Attack surface | Argument parser (pre-auth) | Permission check |

**Key insight**: The overflow happens in `set_cmnd()` — the function that
parses arguments — which runs **before** sudo ever consults `/etc/sudoers`.
An account created 10 seconds ago with zero permissions can exploit this.

---

## Project Structure

```
CVE-2021-3156-Project/
│
├── README.md                        ← you are here
│
├── lab/                             ← Member 1: Lab Environment
│   ├── Dockerfile                   ← Ubuntu 20.04 + sudo 1.8.31 (pinned)
│   ├── docker-compose.yml           ← vulnerable target + patched reference
│   ├── evidence_helper.sh           ← pre/post-exploit state capture
│   ├── SETUP.md                     ← step-by-step VM/Docker guide
│   └── config_notes.md              ← CVE conditions & container details
│
├── exploit/                         ← Member 2: Exploit Development
│   ├── exploit.py                   ← Python LPE framework + canary test
│   └── payloads.txt                 ← heap overflow research notes
│
├── docs/                            ← Member 3: Research & Documentation
│   ├── root_cause_analysis.md       ← set_cmnd() deep dive + off-by-one
│   ├── references.md                ← all sources, PoCs, CWE mapping
│   └── mitigation.md                ← sudo upgrade + hardening checklist
│
├── proof/                           ← Member 4: Evidence Collection
│   ├── screenshots/                 ← exploitation screenshots
│   └── terminal_logs.txt            ← command output template + logs
│
└── report/
    └── CVE-2021-3156_Report.docx    ← Member 4: Final professional report
```

---

## Team Deliverables

### Member 1 — Lab Environment & CVE Verification
| File | Description |
|---|---|
| `lab/Dockerfile` | Ubuntu 20.04 with sudo 1.8.31 pinned (vulnerable); Python 3 installed; `labuser` account with NO sudo access |
| `lab/docker-compose.yml` | Orchestrates vulnerable target + patched Ubuntu 22.04 reference container |
| `lab/evidence_helper.sh` | Bash script to capture system state (user, sudo version, canary) before/after exploit |
| `lab/SETUP.md` | Step-by-step: build → start → enter → verify sudo version → run canary → snapshot |
| `lab/config_notes.md` | Explains why no misconfig needed, Docker security settings, credential reference |

### Member 2 — Exploit Development (PoC Script)
| File | Description |
|---|---|
| `exploit/exploit.py` | Full Python framework: `check_platform()`, `check_sudo_version()`, `run_canary_test()`, `get_system_info()` + three exploit TODO stubs (`select_heap_strategy`, `build_overflow_argument`, `trigger_overflow_and_escalate`) with detailed references to blasty/worawit PoCs |
| `exploit/payloads.txt` | Heap overflow concepts, COMPRESSION_TRANSFORM equivalent (argument structure), three heap strategies, failed attempt log template, detection signatures |

> **Note**: Working kernel/heap exploit code is not included per ethical guidelines.
> The `exploit.py` TODO stubs reference `https://github.com/blasty/CVE-2021-3156`
> and `https://github.com/worawit/CVE-2021-3156` as the authoritative public PoCs
> for your team to study and integrate.

### Member 3 — Root Cause Analysis & Research
| File | Description |
|---|---|
| `docs/root_cause_analysis.md` | Detailed: `set_cmnd()` size vs copy mismatch, off-by-one with code examples, patch diff, exploit chain, CVSS 7.8 metric-by-metric, 10-year timeline, distribution impact table |
| `docs/references.md` | Qualys advisory, MITRE, NVD, sudo project, blasty PoC, worawit PoC, ExploitDB, GTFOBins, CWE mapping |
| `docs/mitigation.md` | `apt-get install --only-upgrade sudo`, verification canary, AppArmor hardening, auditd monitoring, hardening table |

### Member 4 — Proof Collection, Reporting & Integration
| File | Description |
|---|---|
| `proof/terminal_logs.txt` | Evidence collection template (fill in with actual lab output) |
| `proof/screenshots/` | Directory for 7 required screenshots |
| `report/CVE-2021-3156_Report.docx` | 12-section professional report: cover page, executive summary, CVE description, root cause analysis, CVSS breakdown, exploitation steps, code explanation, proof checklist, mitigation, timeline, references, disclaimer |

---

## Quick Start

### 1. Build & Start the Lab

```bash
cd CVE-2021-3156-Project/lab/

# Build the vulnerable image (downloads Ubuntu 20.04, pins sudo 1.8.31)
docker compose build

# Start both containers
docker compose up -d

# Confirm containers are running
docker compose ps
```

Expected:
```
NAME                      STATUS
baron_samedit_target      running
baron_samedit_patched     running
```

### 2. Enter the Vulnerable Container

```bash
docker exec -it baron_samedit_target bash
```

### 3. Confirm Vulnerability Conditions

```bash
# Inside the container as labuser

whoami                         # Expected: labuser
id                             # Expected: uid=1000(labuser)...
sudo --version                 # Expected: Sudo version 1.8.31
sudo -l                        # Expected: Sorry, user labuser may not run sudo...
sudoedit -s '\' 2>&1          # Expected: NOT "usage:" → VULNERABLE
```

### 4. Copy and Run the Exploit

```bash
# From host machine
docker cp exploit/exploit.py baron_samedit_target:/home/labuser/

# Inside container
python3 exploit.py --check-only      # verify all prerequisites pass
python3 exploit.py --safe-mode       # canary only, no exploitation
python3 exploit.py --cmd "id"        # LPE → show root identity
python3 exploit.py --cmd "whoami /all" --output /tmp/proof.txt
```

### 5. Capture Evidence

```bash
# Inside container — before exploit
~/evidence_helper.sh > /tmp/before.txt

# After exploit
~/evidence_helper.sh > /tmp/after.txt

# Copy to host
docker cp baron_samedit_target:/tmp/before.txt proof/terminal_logs_before.txt
docker cp baron_samedit_target:/tmp/after.txt  proof/terminal_logs_after.txt
```

---

## How the Exploit Works

```
Step 1: Run 'sudoedit -s '
        ↓
Step 2: sudo calls set_cmnd() to parse arguments in shell mode
        ↓
Step 3: set_cmnd() COUNTS bytes for the cmnd_args buffer (correct size)
        ↓
Step 4: set_cmnd() COPIES bytes — but reads 1 byte past the null
        terminator of any argument ending with '\'
        ↓
Step 5: Off-by-one overflow writes 1 unexpected byte beyond cmnd_args
        ↓
Step 6: Heap grooming (environment variable layout manipulation) ensures
        a valuable sudo struct sits adjacent to the overflowed buffer
        ↓
Step 7: The overflow byte corrupts a pointer in the adjacent struct
        ↓
Step 8: sudo follows the corrupted pointer → executes attacker-controlled
        command (via SUDO_EDITOR) with root privileges
        ↓
Result: uid=0(root) — from a user with ZERO sudo permissions
```

### The Root Cause in One Line
```
size_calculation("A\") = 2 bytes  ≠  copy("A\") = writes 3 bytes → overflow
```

---

## Vulnerability Canary Test

The safest way to confirm CVE-2021-3156 is present — no exploitation required:

```bash
sudoedit -s '\' 2>&1; echo "Exit: $?"
```

| Output | Meaning |
|---|---|
| `sudoedit: /\: not a regular file` | ✅ **VULNERABLE** |
| Segmentation fault / `Exit: 139` | ✅ **VULNERABLE** (crash) |
| `sudoedit: invalid argument` | ❌ **PATCHED** (1.9.5p2+) |
| `usage: sudoedit ...` | ❌ **PATCHED** |

---

## exploit.py Usage

```
Usage: python3 exploit.py [OPTIONS]

Modes (mutually exclusive):
  --check-only        Run all pre-checks only — no exploitation
  --safe-mode         Run canary test only — confirm vulnerability
  --cmd COMMAND       Execute COMMAND as root after successful LPE

Options:
  --verbose, -v       Show detailed heap/system debug output
  --output, -o FILE   Save all output to FILE
  --no-colour         Disable ANSI colour codes (for log files)
  --help              Show this help message

Examples:
  python3 exploit.py --check-only
  python3 exploit.py --safe-mode
  python3 exploit.py --cmd "id"
  python3 exploit.py --cmd "cat /etc/shadow" --output proof/root_output.txt
  python3 exploit.py --cmd "whoami" --verbose
```

### Pre-checks Performed

| Check | What It Does |
|---|---|
| Platform (Linux) | Ensures we are on Linux |
| sudoedit present | Finds sudoedit in PATH |
| sudo version | Compares against vulnerable range (1.8.2–1.8.31p2, 1.9.0–1.9.5p1) |
| Not already root | Confirms UID ≠ 0 (LPE is meaningful) |
| System info | Collects glibc version + architecture for heap strategy |
| Vulnerability canary | Runs `sudoedit -s '\'` and classifies the response |

---

## Lab Reset & Snapshot

### Quick Reset (keep container, clear temp files)
```bash
docker exec baron_samedit_target bash -c "rm -f /tmp/*.txt /tmp/exploit* /home/labuser/exploit.py"
```

### Save a Snapshot
```bash
docker commit baron_samedit_target baron-samedit:clean-state
echo "[+] Snapshot saved as baron-samedit:clean-state"
```

### Restore Snapshot
```bash
docker compose down
docker run -it --name baron_samedit_target baron-samedit:clean-state bash
```

### Full Reset (rebuild from scratch)
```bash
docker compose down -v
docker compose up -d --build
```

---

## Patched vs Vulnerable Comparison

| Test | Vulnerable (sudo 1.8.31) | Patched (sudo 1.9.5p2+) |
|---|---|---|
| `sudo --version` | `Sudo version 1.8.31` | `Sudo version 1.9.x` |
| `sudoedit -s '\'` | `not a regular file` or segfault | `invalid argument` |
| `exploit.py --safe-mode` | Canary: PASS → VULNERABLE | Canary: FAIL → PATCHED |
| `exploit.py --cmd id` | `uid=0(root)` | Fails at check stage |
| Patch present? | KB absent | Patch applied |

To test on patched container:
```bash
docker exec -it baron_samedit_patched bash
# Then repeat the canary test — should output "invalid argument"
```

---

## References

| Source | URL |
|---|---|
| Qualys Advisory | https://blog.qualys.com/vulnerabilities-threat-research/2021/01/26/cve-2021-3156-heap-based-buffer-overflow-in-sudo-baron-samedit |
| MITRE CVE | https://vulners.com/cve/CVE-2021-3156 |
| NVD | https://nvd.nist.gov/vuln/detail/CVE-2021-3156 |
| sudo Advisory | https://www.sudo.ws/security/advisories/unescape_overflow/ |
| blasty PoC | https://github.com/blasty/CVE-2021-3156 |
| worawit PoC | https://github.com/worawit/CVE-2021-3156 |
| ExploitDB #49521 | https://www.exploit-db.com/exploits/49521 |
| Rapid7 Metasploit | https://www.rapid7.com/db/modules/exploit/linux/local/sudo_baron_samedit/ |
| GTFOBins — sudo | https://gtfobins.github.io/gtfobins/sudo/ |

---

## Ethical Notice

```
┌─────────────────────────────────────────────────────────────────┐
│  This project was created for EDUCATIONAL PURPOSES ONLY as      │
│  part of the ITSOLERA Cybersecurity Red Team Internship 2026.   │
│                                                                 │
│  ✅ DO:  Use against the isolated Docker lab only               │
│  ✅ DO:  Study the vulnerability to understand heap exploits    │
│  ✅ DO:  Contribute findings to the team report                 │
│                                                                 │
│  ❌ DON'T: Run against any real system, VM, or cloud instance   │
│  ❌ DON'T: Share outside the internship programme               │
│  ❌ DON'T: Use for any unauthorised access                      │
└─────────────────────────────────────────────────────────────────┘
```

---

*ITSOLERA Cybersecurity Department — Red Team Internship, Summer 2026*