Exploit for linux-privesc-lab

## https://sploitus.com/exploit?id=E6929E03-C2BF-5642-AEA2-2F410434D222
# linux-privesc-lab

**Linux Privilege Escalation Vulnerability Lab**. Each vulnerability environment is stored as a separate directory, containing the corresponding Docker configuration, vulnerability exploitation scripts, and documentation explaining the principles. It’s ready to use right out of the box, similar to the vulhub lab. Since Docker shares the kernel with the host machine, no environments for kernel privilege escalation are provided in this project. All environments have been tested in real scenarios (Kali 2026.2 / Docker 29.7.2). Details of the testing results can be found in the “Verification Results” section of each directory's README file.

## Environment List

| Directory | Vulnerability/Scenario | Verification Status |
|:---|:---|:---|
| sudo-nopasswd | Dangerous sudo NOPASSWD command escalation (find/python3/vim) | Reproduced |
| sudo-cve-2019-14287 | CVE-2019-14287: sudo user ID bypass | Requires sudo < 1.8.28 |
| sudo-cve-2023-22809 | CVE-2023-22809: sudoedit EDITOR injection | Requires sudo < 1.9.12p2 |
| suid | SUID escalation (find/vim/less/base64/python3) | Reproduced |
| capabilities | Linux capabilities (cap_setuid) escalation | Reproduced |
| cron-writable-script | Cron writable script escalation | Reproduced |
| cron-tar-wildcard | Cron tar wildcard parameter injection | Reproduced |
| cron-path-hijack | Cron PATH hijacking | Reproduced |
| passwd-writable | /etc/passwd writable escalation | Reproduced |
| shadow-readable | /etc/shadow readable + john cracking | Reproduced |
| ld-preload | LD_PRELOAD environment variable hijacking | Reproduced |
| bash-func-hijack | BASH_FUNC_ environment function hijacking | Reproduced |
| mysql-udf | MySQL UDF escalation (sys_exec/sys_eval) | Reproduced |

## Quick Start

Each environment directory is built and started independently, with unified accounts:

- Low-privilege user: lowpriv / lowpriv123
- Root: toor
- MySQL root (mysql-udf environment): root

```bash
# Enter a specific vulnerability environment
cd sudo-nopasswd

# Build and start the environment
docker compose up -d --build

# Enter the low-privilege user’s shell
docker exec -it $(docker compose ps -q) su - lowpriv

# View the exploitation instructions for this environment
cat README.md

# Execute the exploit with the low-privilege user
bash /opt/exploits/exploit.sh
```

**Domestic network acceleration**: All images use DaoCloud’s domestic proxy prefix (m.daocloud.io/docker.io/...). The apt repository has been replaced with Alibaba Cloud sources. For configuring Docker daemon-level image acceleration, see docs/mirror.md.

## Directory Structure

```
linux-privesc-lab/
├── README.md                    # This file
├── docs/
│   └── mirror.md                # Guide to configuring domestic Docker image sources
├── sudo-nopasswd/               # Each environment contains:
│   ├── Dockerfile               # Docker image configuration
│   ├── docker-compose.yml       # One-click orchestration
│   ├── exploit.sh               # Vulnerability exploitation script (runs directly)
│   └── (Source code/Compilation script)  # Preinstalled in /opt/exploits
│   └── README.md                # Explanations, reproduction steps, and verification records
├── sudo-cve-2019-14287/
├── sudo-cve-2023-22809/
├── suid/
├── capabilities/
├── cron-writable-script/
├── cron-tar-wildcard/
├── cron-path-hijack/
├── passwd-writable/
├── shadow-readable/
├── ld-preload/
├── bash-func-hijack/
└── mysql-udf/
```

## Disclaimer

This lab is only used for security testing and educational research in authorized environments. It is prohibited from being used for illegal purposes.