search

TH3xACE / SUDO_KILLER

A tool designed to exploit a privilege escalation vulnerability in the sudo program on Unix-like systems. It takes advantage of a specific misconfiguration or flaw in sudo to gain elevated privileges on the system, essentially allowing a regular user to execute commands as the root user.
MIT License
2.22k stars 254 forks source link

Error -> Checking for disclosed vulnerabilities related to version used (CVE) #12

Closed b0x-Protector closed 4 years ago

b0x-Protector commented 4 years ago

It's me again :)

It might be better to add a check for "cve_vuln", as well as slightly tweak the calculation of "cvepath" (line 273 and 275).

if [ "$cve_vuln" ]; then   #add
  while read -r line; do
    #cvepath=`ls -al exploits/ | grep "$line" | cut -d " " -f 12`
    cvepath=`ls -al exploits/ | grep "$line" |tr -s " " |cut -d " " -f 9` #mod
  ...
done <<< "$cve_vuln"
fi  #add

Otherwise, the path to cve is not displayed and the incorrect result is displayed if "cve_vuln" is empty.

TH3xACE commented 4 years ago

cve_vuln will never be empty ? what the point of checking that ?? it is additional processing for nothing ? what do you think ? if your cve_vuln is empty, there is something that you did wrong.... maybe you copied only the .sh

TH3xACE commented 4 years ago

I will add the check just in case someone copy only the sh... the one on the cve_path is a good one.. thanks... I have added it... will be in the coming push.

b0x-Protector commented 4 years ago

cve_vuln will never be empty ? what the point of checking that ?? it is additional processing for nothing ? what do you think ? if your cve_vuln is empty, there is something that you did wrong.... maybe you copied only the .sh

I just set the non existing version of SUDO, namely sver_tmp=1.8.177p1

TH3xACE commented 4 years ago

I think there was previous check that you missed.... try to use the docker for the testing....there is a video on how to use it.

b0x-Protector commented 4 years ago

I think there was previous check that you missed.... try to use the docker for the testing....there is a video on how to use it.

Perhaps, but initially this error appeared due to the fact that “SUDO 1.8.17p1” was not in cve.sudo2.txt. As a result, _cvevuln=`cat cve.sudo2.txt | grep "$ (echo $ sver)" | cut -d "+" -f 1` returned an empty string. When I set the "correct" SUDO version, the error disappeared.

TH3xACE commented 4 years ago

I see... then yes, there is a possibility that cve_vuln is empty when there is no match for the sudo version... then the check is that you proposed it legitimate... thanks for this issue :) :+1: