README - sudo-chwoot.sh

Description

This script is a proof of concept (PoC) that demonstrates a privilege escalation technique exploiting a theoretical vulnerability in 'sudo' (e.g. CVE-2025-32463).

The PoC forces 'sudo' to load a manipulated .so library by leveraging the '-R' (chroot) functionality and a custom nsswitch.conf configuration.

Warning: This script is for research or testing purposes only in controlled environments. It must not be executed on production systems or on machines you do not own or manage.

Objective

• Create a temporary environment containing a custom NSS configuration.
• Inject a .so library inside a chroot structure.
• Use 'sudo -R' to force the library to be loaded and obtain the execution of a command with elevated privileges.

Main Changes

The main change compared to the original script is the integration of the .so library directly inside the script in base64 format.

Before: The .so library had to exist as an external file in the filesystem and was copied with: cp "$SCRIPT_DIR/woot1337.so.2" libnss_/woot1337.so.2

Now: The .so library is included in the script in textual format (base64) and is written dynamically to the temporary filesystem at runtime, using:

    cat << 'EOF' | base64 -d > libnss_/woot1337.so.2
    (base64 content here)
    EOF

Temporary Filesystem Structure

The script creates a structure like this:

/tmp/sudowoot.stage.xxxxxx/ ├── woot/ │ └── etc/ │ ├── nsswitch.conf (manipulated configuration) │ └── group (copy of /etc/group) └── libnss_/ └── woot1337.so.2 (.so library decoded from base64)

Step-by-Step Operation

1. The script creates a temporary directory with mktemp.
2. Sets the command to execute (default: /bin/bash, or the arguments passed).
3. Creates the directory structure woot/etc and libnss_.
4. Writes an nsswitch.conf file that forces the loading of a custom NSS module: passwd: /woot1337
5. Copies the /etc/group file into woot/etc.
6. Decodes and writes the .so library from base64.
7. Executes 'sudo -R woot $CMD', which starts the specified command in the chroot context, loading the altered NSS configuration and the .so library.
8. Removes the temporary directory.

Execution

To make the script executable:

chmod +x sudo-chwoot.sh

Standard execution:

./sudo-chwoot.sh
    - Starts a root shell (if the exploit succeeds)

Execution with a command:

./sudo-chwoot.sh id
    - Runs 'id' as root (if the exploit succeeds)

How to Generate the Base64 Payload

To integrate a custom .so library into the script, first convert it to base64:

base64 woot1337.so.2 > woot1337.so.2.b64

Then copy the content of the .b64 file into the script in the section:

cat << 'EOF' | base64 -d > libnss_/woot1337.so.2
(paste the base64 content here)
EOF

Security Notes

Using .so libraries dynamically loaded via NSS and chroot can lead to the execution of arbitrary code with elevated privileges. This type of exploit should only be used in testing contexts and never on real systems without explicit authorization.

Disclaimer

This script is provided for educational and research purposes only. The author assumes no responsibility for any misuse of the code, nor for any damages caused. Use only in lab environments, with awareness and authorization.