https://github.com/blasty/CVE-2021-3156

https://github.com/blasty/CVE-2021-3156

Last synced: 22 days ago
JSON representation

• Host: GitHub
• URL: https://github.com/blasty/CVE-2021-3156
• Owner: blasty
• Created: 2021-01-30T20:39:58.000Z (almost 4 years ago)
• Default Branch: main
• Last Pushed: 2021-02-02T17:07:09.000Z (almost 4 years ago)
• Last Synced: 2024-08-05T17:25:24.377Z (4 months ago)
• Language: C
• Size: 14.6 KB
• Stars: 940
• Watchers: 27
• Forks: 237
• Open Issues: 17
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

• awesome-hacking-lists - blasty/CVE-2021-3156 - (C)

README

        
# CVE-2021-3156 PoC

## Introduction

This is an exploit for the `CVE-2021-3156` sudo vulnerability (dubbed [Baron Samedit](https://www.qualys.com/2021/01/26/cve-2021-3156/baron-samedit-heap-based-overflow-sudo.txt) by Qualys).

## Usage

build:

```

$ make

```

list targets:

```

$ ./sudo-hax-me-a-sandwich

```

run:

```

$ ./sudo-hax-me-a-sandwich 

```

manual mode:

```

$ ./sudo-hax-me-a-sandwich    

```

## Bruteforce target finding (experimental)

Make sure you have [GNU parallel](https://ftpmirror.gnu.org/parallel/parallel-latest.tar.bz2) installed.

```

$ make brute

$ ./brute.sh      

```

some defaults to try:

```

$ ./brute.sh 90 120 50 70 150 300

```

Will eat up all available cores. Don't try to netflix & brute.

## Contributing

Send (sensible) PR's, I might merge.

Some ideas:

* More targets

* Target finding

* Other exploitation strategies

* More self contained functionality:

    * Embed shared library hax.c (Make it small please, ELF golf + asm setuid/execve stub)

    * Add mkdir logic to hax.c

* Directory/shared library cleanup