KaraZajac 6960d2076d docs: record sudo_host (CVE-2025-32462) confirmed landing root ...

sudo_host works as shipped — no code change. VM-verified on Ubuntu 22.04.0 /
sudo 1.9.9-1ubuntu2: with a host-restricted sudoers rule (scoped to a host that
is neither the current hostname nor ALL) and a resolvable host name,
`sudo -h <host> <cmd>` runs as uid 0 (the -h/--host authorization-logic flaw).
Module confirmed EXPLOIT_OK with a real uid=0 witness and popped a root shell.
The only preconditions are environmental (the host-restricted rule, common with
fleet-wide/LDAP/SSSD sudoers, supplied via SKELETONKEY_SUDO_HOST) — not a bug.

VERIFICATIONS.jsonl + EXPLOITED.md updated.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0118iUgHY44hdRtANgyCmu7y

2026-07-23 21:34:24 -04:00

..

.nojekyll

site: GitHub Pages landing page

2026-05-17 02:14:15 -04:00

app.js

release v0.9.9: install.sh needs no sudo + CVE metadata drift fix

2026-06-08 10:16:24 -04:00

ARCHITECTURE.md

core/host: shared host fingerprint refactor

2026-05-22 23:18:00 -04:00

CVE_METADATA.json

modules: add refluxfs (CVE-2026-64600, "RefluXFS" XFS reflink CoW ILOCK race)

2026-07-23 17:49:40 -04:00

DEFENDERS.md

rename: IAMROOT → SKELETONKEY across the entire project

2026-05-16 22:43:49 -04:00

DETECTION_PLAYBOOK.md

skeletonkey: --explain MODULE — single-page operator briefing

2026-05-23 10:49:46 -04:00

ETHICS.md

rename: IAMROOT → SKELETONKEY across the entire project

2026-05-16 22:43:49 -04:00

EXPLOITED.md

docs: record sudo_host (CVE-2025-32462) confirmed landing root

2026-07-23 21:34:24 -04:00

index.html

modules: add refluxfs (CVE-2026-64600, "RefluXFS" XFS reflink CoW ILOCK race)

2026-07-23 17:49:40 -04:00

JSON_SCHEMA.md

release: bump version to v0.6.0

2026-05-23 00:22:18 -04:00

KEV_CROSSREF.md

modules: add refluxfs (CVE-2026-64600, "RefluXFS" XFS reflink CoW ILOCK race)

2026-07-23 17:49:40 -04:00

LAUNCH.md

release v0.9.9: install.sh needs no sudo + CVE metadata drift fix

2026-06-08 10:16:24 -04:00

OFFSETS.md

rename: IAMROOT → SKELETONKEY across the entire project

2026-05-16 22:43:49 -04:00

og.png

docs: regenerate og.png with skeletonkey.netslum.io URL

2026-07-13 17:25:55 -04:00

og.svg

docs: regenerate og.png with skeletonkey.netslum.io URL

2026-07-13 17:25:55 -04:00

RELEASE_NOTES.md

refluxfs: drop the redundant standalone verify harness

2026-07-23 18:50:58 -04:00

style.css

README + site + binary: surface 22-of-26 VM-verified count

2026-05-23 18:03:38 -04:00

VERIFICATIONS.jsonl

docs: record sudo_host (CVE-2025-32462) confirmed landing root

2026-07-23 21:34:24 -04:00