CVE-2021-3156-Project/
│
├── README.md                        ← you are here
│
├── lab/                             ← Member 1: Lab Environment
│   ├── Dockerfile                   ← Ubuntu 20.04 + sudo 1.8.31 (pinned)
│   ├── docker-compose.yml           ← vulnerable target + patched reference
│   ├── evidence_helper.sh           ← pre/post-exploit state capture
│   ├── SETUP.md                     ← step-by-step VM/Docker guide
│   └── config_notes.md              ← CVE conditions & container details
│
├── exploit/                         ← Member 2: Exploit Development
│   ├── exploit.py                   ← Python LPE framework + canary test
│   └── payloads.txt                 ← heap overflow research notes
│
├── docs/                            ← Member 3: Research & Documentation
│   ├── root_cause_analysis.md       ← set_cmnd() deep dive + off-by-one
│   ├── references.md                ← all sources, PoCs, CWE mapping
│   └── mitigation.md                ← sudo upgrade + hardening checklist
│
├── proof/                           ← Member 4: Evidence Collection
│   ├── screenshots/                 ← exploitation screenshots
│   └── terminal_logs.txt            ← command output template + logs
│
└── report/
    └── CVE-2021-3156_Report.docx    ← Member 4: Final professional report

cd CVE-2021-3156-Project/lab/

# Build the vulnerable image (downloads Ubuntu 20.04, pins sudo 1.8.31)
docker compose build

# Start both containers
docker compose up -d

# Confirm containers are running
docker compose ps

NAME                      STATUS
baron_samedit_target      running
baron_samedit_patched     running

docker exec -it baron_samedit_target bash

# Inside the container as labuser

whoami                         # Expected: labuser
id                             # Expected: uid=1000(labuser)...
sudo --version                 # Expected: Sudo version 1.8.31
sudo -l                        # Expected: Sorry, user labuser may not run sudo...
sudoedit -s '\' 2>&1          # Expected: NOT "usage:" → VULNERABLE

# From host machine
docker cp exploit/exploit.py baron_samedit_target:/home/labuser/

# Inside container
python3 exploit.py --check-only      # verify all prerequisites pass
python3 exploit.py --safe-mode       # canary only, no exploitation
python3 exploit.py --cmd "id"        # LPE → show root identity
python3 exploit.py --cmd "whoami /all" --output /tmp/proof.txt

# Inside container — before exploit
~/evidence_helper.sh > /tmp/before.txt

# After exploit
~/evidence_helper.sh > /tmp/after.txt

# Copy to host
docker cp baron_samedit_target:/tmp/before.txt proof/terminal_logs_before.txt
docker cp baron_samedit_target:/tmp/after.txt  proof/terminal_logs_after.txt

Step 1: Run 'sudoedit -s <crafted_argument>'
        ↓
Step 2: sudo calls set_cmnd() to parse arguments in shell mode
        ↓
Step 3: set_cmnd() COUNTS bytes for the cmnd_args buffer (correct size)
        ↓
Step 4: set_cmnd() COPIES bytes — but reads 1 byte past the null
        terminator of any argument ending with '\'
        ↓
Step 5: Off-by-one overflow writes 1 unexpected byte beyond cmnd_args
        ↓
Step 6: Heap grooming (environment variable layout manipulation) ensures
        a valuable sudo struct sits adjacent to the overflowed buffer
        ↓
Step 7: The overflow byte corrupts a pointer in the adjacent struct
        ↓
Step 8: sudo follows the corrupted pointer → executes attacker-controlled
        command (via SUDO_EDITOR) with root privileges
        ↓
Result: uid=0(root) — from a user with ZERO sudo permissions

size_calculation("A\") = 2 bytes  ≠  copy("A\") = writes 3 bytes → overflow

sudoedit -s '\' 2>&1; echo "Exit: $?"

Usage: python3 exploit.py [OPTIONS]

Modes (mutually exclusive):
  --check-only        Run all pre-checks only — no exploitation
  --safe-mode         Run canary test only — confirm vulnerability
  --cmd COMMAND       Execute COMMAND as root after successful LPE

Options:
  --verbose, -v       Show detailed heap/system debug output
  --output, -o FILE   Save all output to FILE
  --no-colour         Disable ANSI colour codes (for log files)
  --help              Show this help message

Examples:
  python3 exploit.py --check-only
  python3 exploit.py --safe-mode
  python3 exploit.py --cmd "id"
  python3 exploit.py --cmd "cat /etc/shadow" --output proof/root_output.txt
  python3 exploit.py --cmd "whoami" --verbose

docker exec baron_samedit_target bash -c "rm -f /tmp/*.txt /tmp/exploit* /home/labuser/exploit.py"

docker commit baron_samedit_target baron-samedit:clean-state
echo "[+] Snapshot saved as baron-samedit:clean-state"

docker compose down
docker run -it --name baron_samedit_target baron-samedit:clean-state bash

docker compose down -v
docker compose up -d --build

docker exec -it baron_samedit_patched bash
# Then repeat the canary test — should output "invalid argument"

┌─────────────────────────────────────────────────────────────────┐
│  This project was created for EDUCATIONAL PURPOSES ONLY as      │
│  part of the ITSOLERA Cybersecurity Red Team Internship 2026.   │
│                                                                 │
│  ✅ DO:  Use against the isolated Docker lab only               │
│  ✅ DO:  Study the vulnerability to understand heap exploits    │
│  ✅ DO:  Contribute findings to the team report                 │
│                                                                 │
│  ❌ DON'T: Run against any real system, VM, or cloud instance   │
│  ❌ DON'T: Share outside the internship programme               │
│  ❌ DON'T: Use for any unauthorised access                      │
└─────────────────────────────────────────────────────────────────┘