leviathan/SKELETONKEY
1
1
Fork 0
Code Issues Pull Requests Actions 23 Packages Projects Releases Wiki Activity

docs: record sudo_host (CVE-2025-32462) confirmed landing root
build / build (clang / debug) (push) Waiting to run
Details
build / build (clang / default) (push) Waiting to run
Details
build / build (gcc / debug) (push) Waiting to run
Details
build / build (gcc / default) (push) Waiting to run
Details
build / sanitizers (ASan + UBSan) (push) Waiting to run
Details
build / clang-tidy (push) Waiting to run
Details
build / drift-check (CISA KEV + Debian tracker) (push) Waiting to run
Details
build / static-build (push) Waiting to run
Details

Browse Source 
sudo_host works as shipped — no code change. VM-verified on Ubuntu 22.04.0 /
sudo 1.9.9-1ubuntu2: with a host-restricted sudoers rule (scoped to a host that
is neither the current hostname nor ALL) and a resolvable host name,
`sudo -h <host> <cmd>` runs as uid 0 (the -h/--host authorization-logic flaw).
Module confirmed EXPLOIT_OK with a real uid=0 witness and popped a root shell.
The only preconditions are environmental (the host-restricted rule, common with
fleet-wide/LDAP/SSSD sudoers, supplied via SKELETONKEY_SUDO_HOST) — not a bug.

VERIFICATIONS.jsonl + EXPLOITED.md updated.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0118iUgHY44hdRtANgyCmu7y
This commit is contained in:
KaraZajac
2026-07-23 21:34:24 -04:00
parent 70972e0c9d
commit 6960d2076d
2 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/EXPLOITED.md
+1
View File
@@ -28,6 +28,7 @@ tamper check).
| `pwnkit` | CVE-2021-4034 | Ubuntu 20.04.0 / polkit 0.105-26ubuntu1 | **after a fix** — see below |
| `sudo_runas_neg1` | CVE-2019-14287 | Ubuntu 18.04.2 / sudo 1.8.21p2 + sudoers `(ALL,!root)` | `sudo -u#-1` → uid 0 |
| `sudoedit_editor` | CVE-2023-22809 | Ubuntu 22.04.0 / sudo 1.9.9 + sudoers `sudoedit` grant | **after 2 fixes** — `chdir("/")` + helper basename match; `su skel` → uid 0 |
| `sudo_host` | CVE-2025-32462 | Ubuntu 22.04.0 / sudo 1.9.9 + host-restricted sudoers rule | works as shipped; `sudo -h <host>` → uid 0 (needs a host-scoped rule + resolvable host) |
## Fixed this session