Exploit for Inclusion of Functionality from Untrusted Control Sphere in Sudo Project Sudo

## https://sploitus.com/exploit?id=83D35F8D-7E05-5A2C-B406-36C0E4B1D247
# CVE-2025-32463 Vulnerability Experiment Environment

[![Docker Pulls](https://img.shields.io/docker/pulls/y4ney/cve-2025-32463-lab)](https://hub.docker.com/r/y4ney/cve-2025-32463-lab)  
[![Docker Image Version](https://img.shields.io/docker/v/y4ney/cve-2025-32463-lab?sort=date)](https://hub.docker.com/r/y4ney/cve-2025-32463-lab)  

![](./image/banner.png)

This project creates an experiment environment using Docker to reproduce and test the **CVE-2025-32463** vulnerability related to local privilege escalation via `sudo`. The image includes the affected version of `sudo`, along with exploit scripts and auxiliary tools, suitable for security researchers and learners to practice analysis. > 🐳 The image has been published on Docker Hub and can be directly pulled:  
> - [y4ney/cve-2025-32463-lab:deb](https://hub.docker.com/r/y4ney/cve-2025-32463-lab/tags?page=1&name=deb)  
> - [y4ney/cve-2025-32463-lab:source](https://hub.docker.com/r/y4ney/cve-2025-32463-lab/tags?page=1&name=source)  

## 📁 Project Structure Explanation

| File/Directory | Description |
|--------------|-----------------|
| [docker/deb/Dockerfile](./docker/deb/Dockerfile)| Environment built using the official `.deb` package |
| [docker/source/Dockerfile](./docker/source/Dockerfile)| Environment built from source code, suitable for debugging and analysis |
| [docker/sudo-chwoot.sh](./docker/sudo-chwoot.sh)| Exploit script that exploits the chroot privilege bypass and gains root shell access |
| [docker/build.sh](./docker/build.sh)| Script for automatically building all Docker images |
| [From CVE-2025-32463: Container Isolation Security](./from%20CVE-2025-32463%20talking%20about%20chroot%20container%20isolation%20security.md)| Learning documentation |

## 🚀 Quick Start

1. Pull one of the image versions to your local machine for testing:  
   ```Bash
   docker run -it --rm y4ney/cve-2025-32463-lab:source bash
   ```

   Or:  
   ```Bash
   docker run -it --rm y4ney/cve-2025-32463-lab:deb bash
   ```

2. Execute the PoC script in your working directory. You can append any commands; if left empty, it will open an interactive `bash` terminal:  
   ```Bash
   ./sudo-chwoot.sh id
   ./sudo-chwoot.sh 
   ```

3. Since the `--rm` parameter is added when starting the container, exiting the container will cause it to be destroyed automatically. To delete the image, use the following commands:  
   ```Docker
   docker rmi y4ney/cve-2025-32463-lab:source
   ```

   Or:
   ```Docker
   docker rmi y4ney/cve-2025-32463-lab:deb
   ```

![](./image/image_431f2OMa-_.png)

## 🔨 Building the Image

1. Clone the project:  
   ```Bash
   git clone https://github.com/y4ney/CVE-2025-32463-lab.git
   cd cve-2025-32463-lab
   ```

2. Enter the `docker` directory and run the build script:  
   ```Bash
   cd docker
   ./build.sh 
   ```

3. This script will build the following images:  
   * `/cve-2025-32463-lab:deb`: Environment built using the official `.Deb` package |
   * `/cve-2025-32463-lab:source`: Environment built from source code, suitable for debugging and analysis |

4. Start a container and enter an interactive terminal:  
   ```Bash
   docker run -it --rm /cve-2025-32463-lab:source bash
   ```

   Or:
   ```Bash
   docker run -it --rm /cve-2025-32463-lab:deb bash
   ```

5. Run the exploit script in the container:  
   ```Bash
   ./sudo-chwoot.sh
   ```

   If the exploit is successful, you will gain root privileges within the container. ## 🔧 Environment Requirements

Ensure that the following tools are installed and configured on your system:  
* Docker  
* Bash (for running `.sh` scripts)  
* If the script lacks execution permissions, use `chmod +x *.sh` to add execution rights

## 📄 License

This project uses the MIT open-source license. You are welcome to use and modify it freely.