CVE-2025-32463 Vulnerability Lab Environment

This project builds an experimental environment based on Docker for reproducing and testing the sudo local privilege escalation vulnerability CVE-2025-32463. The image contains the affected version of sudo, along with exploit scripts and auxiliary tools, suitable for security researchers and learners to practice analysis.

🐳 The image has been published to Docker Hub and can be pulled directly:

• y4ney/cve-2025-32463-lab:deb
• y4ney/cve-2025-32463-lab:source

📁 Project Structure Description

🚀 Quick Start

1. Pull either version of the image and run it locally;

   root@kitploit:~

   docker run -it --rm y4ney/cve-2025-32463-lab:source bash
   

   Or

   root@kitploit:~

   docker run -it --rm y4ney/cve-2025-32463-lab:deb bash
   

2. Execute the PoC script in the working directory. The script can take any command as argument; if no command is provided, it opens an interactive bash shell by default;

   root@kitploit:~

   ./sudo-chwoot.sh id
   ./sudo-chwoot.sh 
   

3. Since we added the --rm parameter when starting the container, the container will be automatically destroyed after exiting the container environment with exit. To delete the image, run the following commands.

   root@kitploit:~

   docker rmi y4ney/cve-2025-32463-lab:source
   

   Or

   root@kitploit:~

   docker rmi y4ney/cve-2025-32463-lab:deb
   

🔨 Build the Image

1. Clone the project

   root@kitploit:~

   git clone https://github.com/y4ney/CVE-2025-32463-lab.git
   cd cve-2025-32463-lab
   

2. Enter the docker directory and run the build script:

   root@kitploit:~

   cd docker
   ./build.sh <your-docker-hub-name>
   

3. The script will build the following images:

   • <your-docker-hub-name>/cve-2025-32463-lab:deb: Environment with the affected version built from official .deb packages
   • <your-docker-hub-name>/cve-2025-32463-lab:source: Environment built from source, suitable for debugging and source code analysis

4. Start the container and enter an interactive terminal:

   root@kitploit:~

   docker run -it --rm <your-docker-hub-name>/cve-2025-32463-lab:source bash
   

   Or

   root@kitploit:~

   docker run -it --rm <your-docker-hub-name>/cve-2025-32463-lab:deb bash
   

5. Run the exploit script inside the container:

   root@kitploit:~

   ./sudo-chwoot.sh
   

If the exploit is successful, you will obtain root privileges inside the container.

🔧 Requirements

Make sure the following tools are installed and configured on your system:

• Docker
• Bash (for running .sh scripts)
• If the script lacks execution permissions, use chmod +x *.sh to add them

📄 License

This project is licensed under the MIT open source license. Feel free to use and modify it.