CVE-2025-32463 Exploit

Overview

This repository provides a Go-based exploit tool for CVE-2025-32463, a critical local privilege escalation vulnerability (CVSS 9.3) in sudo versions 1.9.14 to 1.9.17. It allows unauthorized local users to gain root access by exploiting a flaw in the --chroot (-R) option.

⚠️ Warning: For educational and testing purposes only. Use in isolated environments (e.g., VMs). Not for malicious use.

Vulnerability Details

• CVE ID: CVE-2025-32463
• Affected Versions: sudo 1.9.14–1.9.17
• Impact: Local privilege escalation to root
• Description: The exploit manipulates the chroot environment to load a malicious shared library, setting UID/GID to 0 and spawning a root shell.

Prerequisites

• Go 1.2+
• gcc
• libc-dev
• Vulnerable sudo version
• Non-privileged user with sudo access and --chroot permissions

Quick Start

Download Pre-built Binary

curl -L https://github.com/Nowafen/CVE-2025-32463/releases/download/exploit/exploit -o exploit
chmod +x exploit
./exploit --execution  # Launches root shell

Build from Source

git clone https://github.com/Nowafen/CVE-2025-32463.git
cd CVE-2025-32463
go build -o exploit  # Or use garble for obfuscation
./exploit --execution

Usage

Command	Description
./exploit --help	Show usage help
./exploit --about	Display CVE details
./exploit --execution	Run exploit (opens root shell)
./exploit --execution --silent	Silent mode execution

Verification: In the root shell, run id (should show uid=0(root)) or whoami (should show root).

How It Works (High-Level)

1. Creates temp dir /tmp/sudowoot.stage.*
2. Generates malicious C code (woot1337.c) for root shell
3. Sets up fake chroot with NSS config
4. Compiles to shared lib (libnss_/woot1337.so.2)
5. Runs sudo -R woot woot to load lib and escalate
6. Auto-cleans temp files

Mitigation

• Update sudo to latest version
• Disable chroot: Add Defaults !use_chroot to /etc/sudoers

References

• NVD Entry

Disclaimer

This tool is for security research. The author is not responsible for misuse. Always test responsibly.

---

Built by MNM