CVE-2021-3156 – Sudo Buffer Overflow (Linux)

Baron Samedit Privilege Escalation Exploit

📌 Overview

This project demonstrates the exploitation of CVE-2021-3156 (Baron Samedit), a critical heap-based buffer overflow vulnerability in the Linux sudo utility.

The vulnerability allows a low-privileged user to gain root access through improper argument handling in sudoedit.

🎯 Objectives

• Analyze vulnerability root cause
• Build a vulnerable Linux environment
• Execute public exploit code
• Achieve local privilege escalation
• Document Red Team attack workflow

🛠️ Lab Environment

⚠️ Vulnerability Details

• CVE ID: CVE-2021-3156
• Name: Baron Samedit
• Type: Heap Buffer Overflow
• Impact: Local Privilege Escalation
• Severity: Critical

This vulnerability affects the sudo program and enables attackers to execute arbitrary code with root privileges.

⚙️ Exploitation Process

1. Verified vulnerable sudo version
2. Installed required tools (gcc, git, make)
3. Created low-privileged user
4. Cloned exploit from GitHub
5. Compiled exploit using GCC
6. Executed exploit binary
7. Gained root shell

💥 Result

Privilege escalation successfully achieved:

whoami
root

⚠️ Vulnerability Details

• CVE ID: CVE-2021-3156
• Affected Component: sudo
• Type: Heap-Based Buffer Overflow
• Impact: Privilege Escalation

🔐 Security Impact

• Full system compromise
• Arbitrary command execution
• Unauthorized access to sensitive files
• Persistent malware installation

🧪 Lab Environment

• Platform: VirtualBox
• OS: Ubuntu 20.04
• Tools:
  • Git
  • GCC
  • Linux Terminal

🚀 Exploitation Steps (High-Level)

1. Verify vulnerable sudo version
2. Compile exploit code
3. Execute exploit
4. Gain root shell

⚠️ Detailed exploit steps are documented in the PDF report.

🛡️ Mitigation

• Update sudo to 1.9.5p2 or later
• Apply regular system patches
• Restrict sudo access
• Monitor privilege escalation attempts

📚 References

• MITRE CVE Database
• Exploit-DB
• GTFOBins
• PayloadsAllTheThings

⚡ Disclaimer

This project is created for educational purposes only.

All testing was conducted in a controlled lab environment.
Do not attempt this on systems without proper authorization.