{"repo":"pr0v3rbs/CVE-2025-32463_chwoot","free":true,"listed":false,"github":"https://github.com/pr0v3rbs/CVE-2025-32463_chwoot","clone":"git clone https://github.com/pr0v3rbs/CVE-2025-32463_chwoot.git","description":"Escalation of Privilege to the root through sudo binary with chroot option. CVE-2025-32463","language":"Shell","stars":525,"topics":["docker","docker-container","docker-image","escalate-privilages","exploit","linux","poc","privilege-escalation","privilege-escalation-exploits","proof-of-concept"],"license":"MIT","category":"deployment-docker-iac","readme_excerpt":"CVE-2025-32463 – sudo chroot (\"chwoot\") PoC This repository provides a minimal, reproducible environment to demonstrate the CVE‑2025‑32463 privilege‑escalation flaw in sudo ’s chroot feature. - This vulnerability is reported by Rich Mirch (@0xm1rch on X) @ Stratascale. - Original post: Vulnerability Advisory: Sudo chroot Elevation of Privilege - NVD: CVE-2025-32463 (CVSS 9.3) --- Affected Versions Vulnerable builds of sudo 1.9.14 up to 1.9.17 (all p‑revisions) on most Linux distributions are affected. Security Pages - Ubuntu (CVSS 9.3) - Redhat (CVSS 7.8) - SUSE (CVSS 7.8) - Debian --- Contents File Purpose ------------------ ---------------------------------------------------------------------------------- Dockerfile Builds an Ubuntu 24.04 image with vulnerable sudo 1.9.16p2 and build tools sudo‑chwoot.sh Proof‑of‑concept exploit that spawns a root shell inside the chroot run.sh Helper script that builds the image (if needed) and launches the exploit container --- Quick vulnerability check Test exploit in Docker container run.sh passes --privileged and --rm to Docker so the container cleans itself up when you exit. --- Clean Up Remove the image when you’re done: --- Reference - Stratascale CRU vulnerability note: Vulnerability Advisory: Sudo chroot Elevation of Privilege","default_branch":null,"files":null,"tree":[],"storefront":"/r/pr0v3rbs","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/pr0v3rbs/CVE-2025-32463_chwoot/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}