spotclear.blogg.se - Cve 2019 18634 exploit

#CVE 2019 18634 EXPLOIT ARCHIVE#

RUN adduser -disabled-password -gecos '' testuser Dockerfile RUN adduser -disabled-password -gecos '' sudouser

sudouser for the user which has sudo privileges, and testuser for the user without sudo privileges. My addition to it is the automatic build script to deploy the sudo version I needed to test. 80% of the Dockerfile has been copied from grazfather’s Pwndock.

#CVE 2019 18634 EXPLOIT ARCHIVE#

The Exploit Database is a CVE compliant archive of public exploits and corresponding vulnerable software, developed for use by penetration testers and vulnerability researchers. It would be lighter than a full blown VM and I won’t have to worry about the installation ruining something if it goes wrong. The Exploit Database is a non-profit project that is provided as a public service by OffSec. To not ruin my default Linux installation, I decided to reproduce the bug in a docker container. The stack overflow may allow unprivileged users to escalate to the root accountĪll of these make this bug a very lucarative option for a newbie to start, and since this is just a stack based buffer overflow, I decided to give it a try. Versions 1.7.1 to 1.8.30 inclusive are affectedĮxploiting the bug does not require sudo permissions a user may be able to trigger a stack-based buffer overflow Going through the advisory highlights some of the points which made me think I can use this bug for my first CVE POC. My journey started with a member in the OpenToAll slack group posting a link for some CVE advisory.

There is no impact unless pwfeedback has been enabled.

This bug can be triggered even by users not listed in the sudoers file

This bug allows for Local Privilege Escalation because of a BSS based overflow, which allows for the overwrite of user_details struct with uid 0, essentially escalating your privilege.

I will talk about the methedologies used and why is it such a good bug to begin your real world exploitation skills.

This post is a complete walkthrough for the process of writing an exploit for CVE 2019-18634.