CVE-2025-32463_Sudo_PoC

PoC for CVE-2025-32463: Local privilege escalation in sudo via --chroot. Exploits NSS module injection through crafted chroot environments. Designed for security researchers and lab-only environments.

CVE-2025-32463 - Local Privilege Escalation via sudo --chroot

A Python-based proof-of-concept exploit for CVE-2025-32463 — a local privilege escalation vulnerability in sudo (v1.9.14 - v1.9.17).
This exploit leverages the insecure --chroot option in sudo and malicious NSS resolution to execute code as root.

⚠️ Disclaimer

This code is provided strictly for educational and research purposes only.
Do NOT use on production systems or without explicit authorization.
You are solely responsible for complying with applicable laws and policies.

📖 Vulnerability Overview

CVE-2025-32463 is a local privilege escalation flaw in sudo, introduced by its --chroot (-R) functionality.
If a user is allowed to invoke sudo with the -R flag, they can:

• Create a custom chroot environment
• Inject a fake nsswitch.conf
• Load malicious libnss_Xfiles.so.2
• Trigger a constructor payload when sudo resolves user info — running code as root

🧰 Requirements

• Python 3
• gcc (for compiling the shared object payload)
• A vulnerable sudo binary (v1.9.14 ≤ version < v1.9.17p1)
• A system where sudo allows the use of --chroot (e.g., via sudoers)

Tested on:

• Ubuntu 22.04
• CentOS 8.4 (with downgraded sudo)
• Debian 11

🚀 Usage

git clone https://github.com/yourhandle/CVE-2025-32463-poc.git
cd CVE-2025-32463-poc
python3 exploit.py [-v]