saleemrashid/sudo-cve-2019-18634

Proof of Concept for CVE-2019-18634

CVE-2019-18634

https://www.sudo.ws/alerts/pwfeedback.html

https://nvd.nist.gov/vuln/detail/CVE-2019-18634

Credit to Joe Vennix from Apple Information Security for finding the bug.

sudo-cve-2019-18634's Issues

How to get the offset

it is so cool ,but can you tell me how to get the tgetpass_flags in sudo ,i try to use gdb to get it ,but i fail ,i can not reach the bug.(my english is bad, so dont mind my poor expression)

Can't compile

Some problem on the folow lines:

static_assert(TGP_OFFSET + 2 > KILL_OFFSET * 2);
static_assert(TGP_OFFSET + 2 < KILL_OFFSET * 3);

Ubuntu 18.04.03 amd64
GCC 7.4.0
Sudo version 1.8.21p2

Missing license

Could you please select and add a license for this code? (preferably a copy-left license like the GPL-3?)

Compile issue

Error generated when using make

cc -Os -g3 -std=c99 -Wall -Wextra -Wpedantic -L/usr/local/opt/curl/lib -static -o exploit exploit.c
exploit.c:153:3: error: implicit declaration of function 'static_assert' is invalid in C99 [-Werror,-Wimplicit-function-declaration]
  static_assert(TGP_OFFSET + 2 > KILL_OFFSET * 2, "TGP_OFFSET invalid");
  ^
1 error generated.
make: *** [exploit] Error

Exploit seems to be failing

Trying this on a tryhackme box https://tryhackme.com/room/hackernote that should be vulnerable but it fails with the following message.
exploit: dl-call-libc-early-init.c:37: _dl_call_libc_early_init: Assertion `sym != NULL' failed.
Aborted (core dumped)