CVE-2021-3156 — Baron Samedit
sudo 中的基于堆的缓冲区溢出 → 本地权限提升
ITSOLERA 网络安全部门 | 红队实习 2026
██████╗ █████╗ ██████╗ ██████╗ ███╗ ██╗ ███████╗ █████╗ ███╗ ███╗███████╗██████╗ ██╗████████╗
██╔══██╗██╔══██╗██╔══██╗██╔═══██╗████╗ ██║ ██╔════╝██╔══██╗████╗ ████║██╔════╝██╔══██╗██║╚══██╔══╝
██████╔╝███████║██████╔╝██║ ██║██╔██╗ ██║ ███████╗███████║██╔████╔██║█████╗ ██║ ██║██║ ██║
██╔══██╗██╔══██║██╔══██╗██║ ██║██║╚██╗██║ ╚════██║██╔══██║██║╚██╔╝██║██╔══╝ ██║ ██║██║ ██║
██████╔╝██║ ██║██║ ██║╚██████╔╝██║ ╚████║ ███████║██║ ██║██║ ╚═╝ ██║███████╗██████╔╝██║ ██║
╚═════╝ ╚═╝ ╚═╝╚═╝ ╚═╝ ╚═════╝ ╚═╝ ╚═══╝ ╚══════╝╚═╝ ╚═╝╚═╝ ╚═╝╚══════╝╚═════╝ ╚═╝ ╚═╝
⚠️ 仅供教育 / 隔离实验室使用
所有测试必须在 Docker 实验室容器内进行。
切勿针对真实、生产或共享系统运行。
目录
- CVE 概述
- 此 CVE 的特殊之处
- 项目结构
- 团队交付物
- 快速开始
- 漏洞利用原理
- 漏洞金丝雀测试
- exploit.py 用法
- 实验室重置与快照
- 已修补与易受攻击版本对比
- 参考资料
CVE 概述
此 CVE 的特殊之处
关键点：溢出发生在 set_cmnd() — 即解析参数的函数 — 该函数在 sudo 查询 /etc/sudoers 之前运行。一个 10 秒前创建、拥有零权限的账户即可利用此漏洞。
项目结构
CVE-2021-3156-Project/
│
├── README.md ← you are here
│
├── lab/ ← Member 1: Lab Environment
│ ├── Dockerfile ← Ubuntu 20.04 + sudo 1.8.31 (pinned)
│ ├── docker-compose.yml ← vulnerable target + patched reference
│ ├── evidence_helper.sh ← pre/post-exploit state capture
│ ├── SETUP.md ← step-by-step VM/Docker guide
│ └── config_notes.md ← CVE conditions & container details
│
├── exploit/ ← Member 2: Exploit Development
│ ├── exploit.py ← Python LPE framework + canary test
│ └── payloads.txt ← heap overflow research notes
│
├── docs/ ← Member 3: Research & Documentation
│ ├── root_cause_analysis.md ← set_cmnd() deep dive + off-by-one
│ ├── references.md ← all sources, PoCs, CWE mapping
│ └── mitigation.md ← sudo upgrade + hardening checklist
│
├── proof/ ← Member 4: Evidence Collection
│ ├── screenshots/ ← exploitation screenshots
│ └── terminal_logs.txt ← command output template + logs
│
└── report/
└── CVE-2021-3156_Report.docx ← Member 4: Final professional report
团队交付物
成员 1 — 实验室环境与 CVE 验证
成员 2 — 漏洞利用开发（PoC 脚本）
注意：按照道德准则，不包含可用的内核/堆漏洞利用代码。
exploit.py 中的 TODO 存根引用 https://github.com/blasty/CVE-2021-3156
和 https://github.com/worawit/CVE-2021-3156 作为权威公开 PoC，
供你的团队研究并集成。
成员 3 — 根因分析与研究
| 文件 | 描述 |
|---|
docs/root_cause_analysis.md | 详细内容：set_cmnd() 的大小计算与拷贝不匹配、含代码示例的 off-by-one 错误、补丁差异、漏洞利用链、CVSS 7.8 逐项指标、10 年时间线、受影响发行版分布表 |
|
成员 4 — 证据收集、报告与集成
| 文件 | 描述 |
|---|
proof/terminal_logs.txt | 证据收集模板（用实际实验室输出填写） |
proof/screenshots/ | 存放 7 张必需截图的目录 |
report/CVE-2021-3156_Report.docx | 12 个部分的专业报告：封面页、执行摘要、CVE 描述、根因分析、CVSS 细分、利用步骤、代码说明、证据清单、缓解措施、时间线、参考资料、免责声明 |
快速开始
1. 构建并启动实验室
cd CVE-2021-3156-Project/lab/
# Build the vulnerable image (downloads Ubuntu 20.04, pins sudo 1.8.31)
docker compose build
# Start both containers
docker compose up -d
# Confirm containers are running
docker compose ps
预期输出：
NAME STATUS
baron_samedit_target running
baron_samedit_patched running
2. 进入易受攻击的容器
docker exec -it baron_samedit_target bash
3. 确认漏洞条件
# Inside the container as labuser
whoami # Expected: labuser
id # Expected: uid=1000(labuser)...
sudo --version # Expected: Sudo version 1.8.31
sudo -l # Expected: Sorry, user labuser may not run sudo...
sudoedit -s '\' 2>&1 # Expected: NOT "usage:" → VULNERABLE
4. 复制并运行漏洞利用程序
# From host machine
docker cp exploit/exploit.py baron_samedit_target:/home/labuser/
# Inside container
python3 exploit.py --check-only # verify all prerequisites pass
python3 exploit.py --safe-mode # canary only, no exploitation
python3 exploit.py --cmd "id" # LPE → show root identity
python3 exploit.py --cmd "whoami /all" --output /tmp/proof.txt
5. 捕获证据
# Inside container — before exploit
~/evidence_helper.sh > /tmp/before.txt
# After exploit
~/evidence_helper.sh > /tmp/after.txt
# Copy to host
docker cp baron_samedit_target:/tmp/before.txt proof/terminal_logs_before.txt
docker cp baron_samedit_target:/tmp/after.txt proof/terminal_logs_after.txt
漏洞利用原理
Step 1: Run 'sudoedit -s <crafted_argument>'
↓
Step 2: sudo calls set_cmnd() to parse arguments in shell mode
↓
Step 3: set_cmnd() COUNTS bytes for the cmnd_args buffer (correct size)
↓
Step 4: set_cmnd() COPIES bytes — but reads 1 byte past the null
terminator of any argument ending with '\'
↓
Step 5: Off-by-one overflow writes 1 unexpected byte beyond cmnd_args
↓
Step 6: Heap grooming (environment variable layout manipulation) ensures
a valuable sudo struct sits adjacent to the overflowed buffer
↓
Step 7: The overflow byte corrupts a pointer in the adjacent struct
↓
Step 8: sudo follows the corrupted pointer → executes attacker-controlled
command (via SUDO_EDITOR) with root privileges
↓
Result: uid=0(root) — from a user with ZERO sudo permissions
根本原因一句话总结
size_calculation("A\") = 2 bytes ≠ copy("A\") = writes 3 bytes → overflow
漏洞金丝雀测试
确认是否存在 CVE-2021-3156 的最安全方式 — 无需进行漏洞利用：
sudoedit -s '\' 2>&1; echo "Exit: $?"
exploit.py 用法
Usage: python3 exploit.py [OPTIONS]
Modes (mutually exclusive):
--check-only Run all pre-checks only — no exploitation
--safe-mode Run canary test only — confirm vulnerability
--cmd COMMAND Execute COMMAND as root after successful LPE
Options:
--verbose, -v Show detailed heap/system debug output
--output, -o FILE Save all output to FILE
--no-colour Disable ANSI colour codes (for log files)
--help Show this help message
Examples:
python3 exploit.py --check-only
python3 exploit.py --safe-mode
python3 exploit.py --cmd "id"
python3 exploit.py --cmd "cat /etc/shadow" --output proof/root_output.txt
python3 exploit.py --cmd "whoami" --verbose
执行的预检查
实验室重置与快照
快速重置（保留容器，清除临时文件）
docker exec baron_samedit_target bash -c "rm -f /tmp/*.txt /tmp/exploit* /home/labuser/exploit.py"
保存快照
docker commit baron_samedit_target baron-samedit:clean-state
echo "[+] Snapshot saved as baron-samedit:clean-state"
恢复快照
docker compose down
docker run -it --name baron_samedit_target baron-samedit:clean-state bash
完全重置（从头重建）
docker compose down -v
docker compose up -d --build
已修补与易受攻击版本对比
如需在已修补的容器上测试：
docker exec -it baron_samedit_patched bash
# Then repeat the canary test — should output "invalid argument"
参考资料
道德声明
┌─────────────────────────────────────────────────────────────────┐
│ This project was created for EDUCATIONAL PURPOSES ONLY as │
│ part of the ITSOLERA Cybersecurity Red Team Internship 2026. │
│ │
│ ✅ DO: Use against the isolated Docker lab only │
│ ✅ DO: Study the vulnerability to understand heap exploits │
│ ✅ DO: Contribute findings to the team report │
│ │
│ ❌ DON'T: Run against any real system, VM, or cloud instance │
│ ❌ DON'T: Share outside the internship programme │
│ ❌ DON'T: Use for any unauthorised access │
└─────────────────────────────────────────────────────────────────┘
ITSOLERA 网络安全部门 — 红队实习，2026 年夏季
