CVE-2019-18634-writeup

Analysis of the CVE-2019-18634 (https://www.exploit-db.com/exploits/47995)

Sudo 1.8.25p - 'pwfeedback' Buffer Overflow (PoC)

Sudo's pwfeedback option can be used to provide visual feedback when the user is inputting their password. For each key press, an asterisk is printed. This option was added in response to user confusion over how the standard Password: prompt disables the echoing of key presses. While pwfeedback is not enabled by default in the upstream version of sudo, some systems, such as Linux Mint and Elementary OS, do enable it in their default sudoers files.

Analysis

Sudo buffer overflow tryhackme writeup

Analysis of the CVE-2019-18634

First we log in to the tryhackme instance via SSH

The vulnerability happens because of the pwfeedback function being vulnerable to a heap buffer overflow, to exploit this vulnerability we first verify that the machine has the vulnerable version of sudo(sudo <1.8.26) present by running the sudo –version command

Analysis of the CVE-2019-18634

First we log in to the tryhackme instance via SSH

The vulnerability happens because of the pwfeedback function being vulnerable to a heap buffer overflow, to exploit this vulnerability we first verify that the machine has the vulnerable version of sudo(sudo <1.8.26) present by running the sudo –version command

confirm ing that the machine has a vulnerable version of sudo we now verify that owfeedback function is present, this can be done 2 ways, by invoking sudo and typing anything into the password prompt, which should display “*” as you type in characters for the password, and the second and more technical way of doing so is by using the sudo -l command, but this will also require the user to have proper permissions that allow them to view information regarding sudo or being able to concatenate the sudoers file

We will now confirm that a buffer overflow is possible by using the test case use on exploit-db https://www.exploit-db.com/exploits/47995

perl -e 'print(("A" x 100 . "\x{00}") x 50)' | sudo -S id ^^The line of code above goes as follows:

Add 100 A characters and pipe it into the sudo command which will then end up in the pwfeedback heap buffer.

Sudo will then spit out a segmentation fault as it is not sure how to continue the sudo process

This happens because once a static heap buffer is flooded, it will begin to flood CPU registers and the instruction pointer, which maintains the flow of the next instruction.

We can run the exploit, which will cause a buffer overflow and give us root access to the system https://www.exploit-db.com/exploits/47995