ricardomaia/cve-2025-32463Provides a containerized environment and signed Nuclei template to safely test CVE-2025-32463, a sudo privilege escalation vulnerability, with detection and patched version comparison.
This is the first time I’ve ported a malicious exploit into a Nuclei template for a non-intrusive vulnerability scan that still demonstrates the underlying issue.
I documented the process in more detail expressly as a learning exercise.
My main challenges were:
-itags local parameter, since the local tag is ignored by default in .nuclei-ignore settings.It may seem weird that I chose the Windows environment for this activity. The fact is that Windows is my default operating system for reasons I won’t go into here.
docker-compose up --build -d
This template uses code engine which requires signing for security reasons. The template is already signed in this repository.
The docker-compose.yaml is configured to mount your Windows Nuclei signing keys from %APPDATA%\nuclei\keys into the containers. This allows the signed template to be verified.
On Windows host (requires Nuclei installed).
nuclei -t cve-2025-32463.yaml -sign
This will sign the template and add a digest field.
Note: The first time you run this command, Nuclei will create signing keys in %APPDATA%\nuclei\keys and prompt for:
Linux/macOS/Git Bash:
docker exec -u testuser vulnerable-sudo-target sh -c 'nuclei -itags local -t /tmp/template.yaml -target localhost -code'
Windows PowerShell/CMD:
docker exec -u testuser vulnerable-sudo-target sh -c "nuclei -itags local -t /tmp/template.yaml -target localhost -code"
Alternative (works on all platforms):
docker exec -u testuser vulnerable-sudo-target nuclei -itags local -t /tmp/template.yaml -target localhost -code
Notes:
-code flag is required to enable code protocol-based templatessh -c '...' to avoid Windows path conversion issues with MSYS2/Git Bash[INF] Executing 1 signed templates from <your-username>Windows PowerShell/CMD:
docker exec -u testuser patched-sudo-target sh -c "nuclei -itags local -t /tmp/template.yaml -target localhost -code"
Alternative (works on all platforms):
docker exec -u testuser patched-sudo-target nuclei -itags local -t /tmp/template.yaml -target localhost -code
Notes:
-code flag is required to enable code protocol-based templates"..." or the alternative command without sh -c[INF] Executing 1 signed templates from <your-username>If you want to verify the vulnerability without signing the Nuclei template, you can run the exploit script directly:
Copy and run the exploit script.
docker cp exploit.sh vulnerable-sudo-target:/tmp/exploit.sh
docker exec -u testuser vulnerable-sudo-target bash /tmp/exploit.sh
Expected output: woot! followed by a root shell (in interactive mode).
[CVE-2025-32463] [code] [critical] localhost ["VULNERABLE UID=1000 EUID=0"]
[INF] Executing 1 signed templates from <your-username>
[INF] Scan completed in 140.454595ms. 1 matches found.
Detection confirmed: UID=1000 EUID=0 proves that code from testuser (1000) executed with root privileges (0).
[INF] Executing 1 signed templates from <your-username>
[INF] Scan completed in 143.319373ms. No results found.
No vulnerability detected - The patched sudo version prevents the library loading.
For detailed technical explanation of the vulnerability, attack vectors, and detection methodology, refer to the Technical Notes document.