Creating The First (Failed) Sudoedit Exploit | Ep. 15

WE CREATED OUR FIRST EXPLOIT! In this video we were able to control the loading of a malicious library. This can be used to execute our own code as root! But it only works when executing it as root; Executing it as a regular user doesn't work...

Episode 15:
00:00 - Intro
00:27 - Recap of Library Loading Exploit Idea
01:45 - Debug a Different Crash
02:28 - Can We Reach dlopen?
03:37 - Using Patterns to find Offsets
05:05 - Writing NULL bytes
05:54 - Create Execution Wrapper sudoenv
07:52 - Debugging the Debug Script
09:00 - Controlling The ni Struct
10:18 - Single Step Exploit Code
11:33 - Create Attack Shared Library
12:17 - First Successful Exploit?
12:58 - Doesn't Work for User
13:16 - Outro

-=[ ❤️ Support ]=-

-=[ 🐕 Social ]=-

[lepsycho]

Damn, I'm on the edge of my seat now! This is so exciting! Keep going!

[erwinheitzman]

This serie is absolutely amazing. Loving it!

[TheRazackk]

I suggest the user env variables as are different as root

[SazianNULL]

I understand exactly nothing how this works but but it is still interesting to watch 🙃

[rikschaaf]

Great series! You make it sound so interesting that it feels like I'm only watching a 3 minute video, but suddenly it's 13 minutes later XD

[valshaev]

Excellent explanation! I was thinking about it for well long time. Nave had no time to try it, work... And the comments are also great!

[moeg]

Wow this is more better than most of the modern anime, specifically the user part at the end.

[xdcountry]

Such an amazing channel— you’re a legend

[dominic]

aaah cliffhangers after cliffhangers.. But great work!

[vrushabhpatil]

thanxx for sharing such a valuable experience with us content was very much informatic

[ThePurpleTux]

My best bet here is that the user env variables are different than users. There's probably a little more to it that I can't even begin to figure out. Either way, this is all really really interesting

[BlackNetworkBit]

I love this content, kind of sad That the end of this serie is near

[wallmenis]

if the next one works ill need it to update the old ubuntu computers if uni. The haven't been updated in a WHILE (probably from 2016)

[simplyhexagon]

Hi! Unfortunately the playlist link is broken in the description

[lklikea]

"Segmentation Faul, Fuck" oh how many times I have muttured that to myself

[nullderef]

just realized that it's been 8 months since the first episode of the series... where has my time went lmao?

[generallyunimportant]

i have one question, why is one of your disks name(the disk os is installed on im assuming) is "redstarOSX"?

[KangJangkrik]

There's a lot of people (including MentalOutlaw channel) say sudo has a lot of vulnerability and doas is better. Please exploit doas to prove them wrong

[activelearner]

Does this exploit works on android phone to?? As i want to install nethunter on my phone but bootloader unlock stucks i have installed tmux planning to execute this vulnerability by dowloading old version if it gives me the key yo unlock boot loader… so aggain

[shapelessed]

Well, now you just wisit NSO's website and liquidate the exploit...