## https://sploitus.com/exploit?id=DE2BA740-D2C5-5E29-AFF7-03A459661975
# sudo CVE-2025 Toolkit
Unified **scanner**, **benign proof-of-concept (PoC)**, and **mitigation** tool about
- **CVE-2025-32462** – `sudo --host` host-scoped policy bypass
- **CVE-2025-32463** – `sudo -R/--chroot` NSS loading leading to local privilege escalation
> ⚠ **Safe PoCs** No shells spawned. CVE-2025-32463 PoC writes a marker file; CVE-2025-32462 PoC uses a no-op `true` command.
---
## Features
- **Scan** Detect vulnerable sudo versions, risky `sudoers` configuration (CHROOT / host-scoped rules).
- **PoC** Benign tests to confirm exploitable behavior if conditions are met.
- **Mitigate**
- Upgrade `sudo` via package manager
- Comment risky `sudoers` lines (backups created)
- Install guardrail wrapper blocking `-R/--chroot` entirely and restricting `--host` to listing only
---
## Usage
```bash
chmod +x sudo-cve-2025-toolkit.sh
./sudo-cve-2025-toolkit.sh
````
Menu options:
1. **Scan** – Detect exposure for both CVEs
2. **PoC** – Select PoC for 32462 or 32463
3. **Mitigate** – Apply temporary protections + upgrade
4. **Exit**
---
## Requirements
* `bash`
* `sudo`
* `gcc` and `ldconfig` (for 32463 PoC)
* Standard Linux utils: `grep`, `awk`, `sed`, `hostname`
---
## Notes
* Fixed in **sudo 1.9.17p1** (or distro backport).
* Remove `/usr/local/bin/sudo` guardrail after patching fleet and reviewing configs.
* Backups of modified `sudoers` entries are stored as `*.bak.YYYYMMDDHHMMSS`.
---
**Author:** w01f
---
**License:** MIT