How SUDO on Linux was HACKED! // CVE-2021-3156

[@PwnFunction]

So basically scream AAAAAAAAAAAAAA\ at sudo and it makes you a sandwich.

[@INeedAttentionEXE]

Make me a sandwich AAAAAAAAAAAAAAAAAAA\

[@zyansheep]

@@INeedAttentionEXE make it yourself

[@Saghetti]

And it makes you a core dump*

[@tamilxctf4075]

YOU'RE here ;-;

[@robinhouben4244]

@@INeedAttentionEXE u forgot the sudoedit

[@LaZZeYT]

Friendship ended with sudo! Now doas is my best friend.

[@JuliusAlphonso]

😂😂😂

[@archie9500]

Doas is the better one anyway, sudo is full of redundant features that a regular user won't use anyway. You could warrant it's use in some server / production environment, with many people having different privileges.

[@Synthels]

sudo is pure bloat

[@tacokoneko]

I fully switched to doas because of this vulnerability. I use Duncaen's port OpenDoas entirely because he sounds smart and won a flamewar with a different port dev

[@anujtomar4234]

Better you review "doas" code before drawing conclusion, who knows whats hidden there. 🤔

[@SimoneAonzo1988]

Man, there's a lot of work behind your *free* videos, thanks so much for sharing!

[@YoIntangible]

Does he have paid videos

[@LiveOverflow]

No, I don’t have any paid courses right now

[@YoIntangible]

@@LiveOverflow cool i didn't think you read comments on old videos

[@marcoschincaglia]

glad to see there was one more video you wanted to make

[@lllSavitarlll]

sounds like many from what he said at the end :)

[@PiotrekR-aka-Szpadel]

This is kind of content that originally bring my attention to your channel, great job

[@arivanhouten6343]

Finally another masterpiece!

[@Scaramouche122]

Van houten?

[@simeondermaats]

@@Scaramouche122 it's a Dutch surname

[@arivanhouten6343]

@@simeondermaats yeah but im still German and this is not my real name (apart from Ari which is apparently my 2nd name)

[@julian_handpan]

AMEN!

[@imamagedude]

Thanks for making this. Code analysis for exploits can seem super impenetrable especially for these old Unix utilities that feel like a fact of life. It's great to have stuff like this showing how you could find an exploit like this on your own. Especially I feel like it's pretty common to get to the point of crashing something and think "OK cool I crashed it, but now what do I do? How do I actually exploit this?", and the segment with GDB really helps with that.

[@jwenting]

I've done it, though not on Linux code (was part of a bug analysis for a program I was maintaining). Found a potential massive security hole by accident going through the code looking for something completely different. Luckily that piece of code had not yet been rolled out to any production server, and the patch was small and easy to deploy to the test servers it was already running on. Sometimes that's all it takes to find an exploit, sheer luck.

[@TheGrimravager]

ahh yesI remember this one. I was on the toilet reading my google feed, coming across an article mentioning it. Aftwards I'd hit sudo apt update and there was an update ready for the sudo program already. I had only updated about 3-4 hours ago, so I was amazed the patch followed me reading the article so quickly :D

[@egoworks5611]

HAHAHAHAHHAHA that also happened to me, bro... I was reading the google now feed and suddenly. the sudo post popped out. Hilarious.

[@jwenting]

quite likely they didn't publish the exploit before they had already pushed the code for the patch to the master repository.

[@stoinks224]

@@jwenting Thats standard practice as they have time beofre expolit is released by securty resaercher as well as info of exploit.

[@CarmelleCodes]

This video is amazing, I'm mind-blown both by the exploit and your clear, concise explanation

[@hamdyahmed5742]

Your channel is really treasure ☺️ Thanks for sharing these videos

[@jacoblobo95]

Kind of got guilt tripped into watching this video but I am SO GLAD I did. There's so much content on CTF's and basic content and I think it's a struggle going from guaranteed exploitable challenges to real world, humongous code bases looking for bugs that could or could not be there. The idea of taking a CVE and trying to go from step 0 to 0 day is perfect, genius even. I can't wait for your new videos and will definitely be looking for a CVE to research myself. You've definitely outdone yourself this time! Thanks so much!!!

[@EvilSapphireR]

You made any progress?

[@miroslavmajer5155]

Man, I salute to your wisdowm, but also your patience to explain it in very easy-to-understand way. Once I read motto "be the senior you needed when you were junior". And you, sir, you are just like that!

[@GeofreySanders]

I'm happy to hear you're not ran out of ideas anymore.

[@pavel9652]

I suspected this kind of deep-dive takes ages to produce. The two weeks of research on the KNOWN bug, I am not even surprised! ;) I don't even want to know how many decades would it take for me to discover the vulnerability in the first place! ;) Thanks for the great video! 11/10 - will watch it again! (note the integer overflow) ;)

[@matthewlandry1352]

I think he is getting his mojo back. He looks happy and motivated. 🧐

[@filda2005]

still out of focus - lens

[@willemme758]

I really like this type of video, I appreciate the effort you put in to research and explain this. Can't wait for the rest of this series

[@pascha4527]

I love how there is people that learned their subject so much that they get that good. I guess i'm easily impressed. Thank you for sharing that with us!

[@ThisIsTheInternet]

This is a genius series idea - I have wanted to see something like this for a long time. The high level stuff is great, but a more in depth version would be good - one where you actually work through the steps, how you're figuring out getting past the various challenges. That might be more work, so maybe a patreon feature? If you want to take it further, maybe try going after allocated but undisclosed CVEs that have been patched. Covering how to attack unknown exploits via source diffing (or binary diffing) would be amazing.

[@JoshuaWolfe]

Great walkthrough and analysis!! I really appreciate the care you took in explaining this from discovery and going slowly into the analysis for an infosec noob like myself 👍

[@TheCramik]

A buffer overflow in your buffer overflow fuzzer, nice one

[@ngzhexuan2]

Thanks for the detailed explanation!! I first stumbled across this CVE on a twitter tweet and always wondered how it works

[@CraneArmy]

totally unrelated. but I've smashed my head against the wall trying to do setup for a process that would run as its own user and spent hours not getting it to run right only to break down and do it with su. this vid answered so many questions for me that I didnt show up trying to answer.

[@ThingEngineer]

Really great video as usual, and I’m glad you found your new path going forward!

[@BRORIGIN]

I can't believe this is free content. Incredibly comprehensive and easy to understand video!

[@akarshitbatra1754]

Easy? I didnt understand anything from this video

[@p20ph37]

Thanks. I appreciate your videos, sir. I also look forward to the upcoming series.

[@wgm-en2gx]

This was very informative. Consider doing a video like this in a way that it could be presented to an non-c/c++ developer. I'd love to present this video to my coworkers. While I understand c/c++, our development is java and .net and i would need to explain ASLR and heaps and the other hard core tech stuff. However, I think they would benefit from knowing the lengths to which hackers can go to exploit something like this and that tools like AFL can be used for good or evil.

[@taragnor]

It's hard to explain it because Java doesn't use pointers, so for the most part if you're using Java, buffer overflows won't happen, at least unless there's a bug in the virtual machine code you're running on. Java won't let you read/write past the bounds of a string in your actual code, so bugs like this really can't happen there. Really this stuff is mostly a C/C++ thing, because those languages have very unsafe string implementations.

[@chrisjames278]

Awesome explanation as always. Looking forward to the series!

[@felchore]

Awesome video, as usual I love your way of navigating through the discovery of this stuff :)

[@mariuskimmina]

Love the idea of this series!

[@josepheverhart329]

You're awesome! Very detailed while comprehendable! Kudos!!

[@JoPraveen]

Romba naal ithuku tha waiting uh thala😍🔥

[@monishkumar9650]

👍

[@AbhishekBM]

Ah, ath thanne

[@Bryzey7]

Damn! Really Cool mate👍 Look forward to the series.

[@gFamWeb]

This is so interesting! It really doesn't look that complicated tbh. Step 1: find a vulnerable function for buffer overflow Step 2: find a way to access that function in a vulnerable state Step 3: find a place to overwrite that could cause arbitrary code execution Fascinating!

[@EvilSapphireR]

lmao not complicated. Imagine discovering this and then actually make a valid exploit for it.

[@TechnicalHeavenSM]

You always make legendary videos with legendary explanations...

[@aromeran]

Nice to see you with new ideas!

[@timus545]

Love your videos, great work. Thanks a lot for creating these videos

[@lightblue254]

2:25 this genius acting caught me so off guard and was so hilarious for some reason :) I love it

[@alicangul2603]

Imagine the vulnerabilities in the Kernel and utilities the NSA knows right now.

[@bjarnestronstrup9122]

What's the point of kernel vulnerabilities when your whole CPU is a backdoor for the NSA XD. Meltdown and Scepter are just the tip of the iceberg of what type of vulnerabilities are hidden in our CPU's, South and North bridges, NIC's and other hardware.

[@gmdzbanwic]

imagine what type of shit you would have on your HDD /SSD if NSA wants it XD

[@Perseagatuna]

@@gmdzbanwic Exactly. I don't know what the fear is lmao. NSA won't just randomly select people to investigate. It's a waste of resources. Unless you are doing some really suspicious stuff, NSA shouldn't investigate you. And even then, nothing will happen if you did nothing. "Which owes nothing fears nothing". Or maybe they do idk I don't work at NSA, seems dumb to me though.

[@PatrikKron]

@@Perseagatuna yet they did mass surveillance as evident by Snowden. Moreover if they save everything, they’ll be able to look through it later to retroactively find something that you might not want to be public.

[@Perseagatuna]

@@PatrikKron Didn't know that since I'm not from the US. That type of shit is illegal, damn...

[@weinihao3632]

This episode was just awesome! Thank you very much!

[@kevinwydler4405]

thanks for this video! this really inspired me to start researching exploitation again

[@meditationsafespace153]

Brilliantly explained. Great video!

[@x32gx]

Inspiring... I'm just getting started on format1 in protostar lol. So... be right with you! :)

[@TheClubPlazma]

Thank you Live Overflow that's great research .

[@javieraguinaga5525]

Love it, great analysis!!! Keep like that

[@emagotis]

Your new ideas for videos has turned out to be great!

[@RandomWitcher]

Man AMAZING video. Insane!

[@jauleris]

I have analyzed this bug also... And those "How did they managed to find this?" moments almost exactly match :DDDD

[@opiniondiscarded6650]

That AFL bit is super helpful

[@somehow_sane]

I am VERY excited for this series!

[@popquizzz]

Not Super Crazy Stuff... This is a Super Awesome Intelligent Analysis and Review!!!! Thank You!!!

[@juewue5054]

Very good Video - super explanation - excellent! Greetings

[@alexhirsch889]

Thank you for this video! It was very easy to follow your thought process, which you clearly laid out. I've used doas under FreeBSD for some time now because of the somewhat ugly (to read) and oversized codebase that sudo has.

[@InfiniteQuest86]

As always, great video. I think you may have overstated the difficulty of setting up afl to fuzz commandline input though. It's a super common thing to do if you fuzz a lot. What I'm partially saying is that it's inexcusable that no one has fuzzed it before. Commandline programs are fuzzed all the time and with afl at that!

[@MeriaDuck]

Already well over 20 years ago I aliased please to sudo. Mainly for self-protection: on a university server sudo would notify system administrators that a student (me) 'accidently' tried sudo. And I was logged into my own linux machine an the uni system in two windows that looked very much the same. At uni, please told me politely that I shouldnt use that. At home, please would do sudo XD

[@cemperable]

If you had just renamed the sudo binary to "please" instead, it would have also protected you from this bug!

[@robmarks6800]

Motivating video! Thank you

[@tg7943]

Thank you very much as always! Awesome! :)

[@MichaelPassIOWA]

Danke schön für diese Erklärung! Very well researched, indeed!

[@almjhoolGOLD]

Keep this kind of stuff coming. We LOVE binary exploitation ❤️.

[@kipchickensout]

Ich mag die Beleuchtung die du da hast - und nette Frise :)

[@dufflepod]

My favourite phrase of the whole video? "...grooming the heap". Nice.

[@jos1532]

OMG This is so highlevel, thanks for this now I reforced the things I still need to learn :)

[@meydanbenmoshe2360]

great series!

[@motbus3]

this new series is neat

[@gentoo6003]

@LiveOverflow what can I use to fuzz source code or binaries themselves(for example Firefox) for RCE’s?

[@typingcat]

Music volume at around 3:30 too high compared to overall voice volume.

[@gruntscrewdriver3261]

Good vid! Im still kinda curious how you couldnt know about NSS?

[@kosmonautofficial296]

Awsome video thank you!

[@Deniied]

You should make a video about the PHP backdoor.

[@naruto73924]

liked it very much. quite a good resource.

[@jonmayer]

5:33 I've been pronouncing the channel as live overflow, as in to live a life. oops

[@faisalinsider]

what video editor do you use, I want to share a video with a look like that

[@eproulx]

Why did the code analyzer tools not find anything?

[@vaff69420]

love the redstar os easter egg :D

[@ejonesss]

what i find amazing is how this eventually got discovered because normally i think such vulnerabilities get discovered accidently for example someone tries to head or tail a file for example and since head and tail displays the first or last part of a file if the file is a binary maybe the system interprets the head or tail output wrongly and not realizing it they have set a memory value and maybe the next time they do something that requires sudo or maybe sudo does not ask for the password or the command is done as if they did sudo. so the only way i can think of is someone decompiled the sudo binary and looked at the code and saw a piece of assembly code that did not look right maybe a jump or copy command and decided to throw stuff at it and got it to work.

[@SoulSukkur]

oh dude, I have a parser written in c, and I created that exact same "blind increment over an escape" bug. do i have to credit you in my capstone now?

[@cpakkala]

Great job, thanks. But I still have one very important question: what is the name of the color scheme used in your editor and/or where can I find a copy of it?

[@Lethaltail]

Are subtitles modifiable in any way by community members? It irks me that KZbin removed such a nice feature.

[@isiraadithya]

Another interesting video!!!

[@PamirTea]

Great explaination.

[@DM-qm5sc]

It's samedit because it's a play on Baron Samedi a character in an old James Bond movie.

[@archangelsgaming767]

Great video! Though I kinda miss CTF writeup video😅

[@pereJobs]

Interesting video, the bug is explained very well. I'd be glad to know more about how MacOS seems to randomize heap allocations. Is that a security feature, or a side effect of some other mechanism ?

[@ariss3304]

I’m honestly surprised that heap layout on Linux is consistent between different runs. That seems like a major flaw.

[@maliusribeiroborges7578]

Is you binary exploitation playlist still relevant?

[@unclejoe8310]

Yes of course. Until we move to quantum computing, in 200 years.

[@Epinardscaramel]

Actually laughed out loud at “Their code was much better than my shitty Python script” 🤣

[@WladcaKsomsou]

Cool video! I've tried reproducing it myself but had problems with automating "heap fengshui". Can you share your whole code, including gdb script?

[@petrovasyka8]

Why you should fuzz as root if we are looking 4 priv esc?

[@jndlf3000]

Could you make a more detailed video about fuzzing in general? How it works / what it actually does? Would love to see that ^-^ Greetings from Darmstadt ^-^

[@maray97]

Thank you for the tutorial, clear as always. I am trying to replicate the CVE in a Docker container, however, when I run sudoedit -s 'AAAAAAAAAAAA\' I get vim opened. I cannot understand why. Could you please help me? I am running Ubuntu 18.04 and. sudo1.9.5p1 (the version before the patch)

[@monkemode8128]

I have no clue what you're talking about but sounds cool 👍

[@oldbootz]

ok ok i watched it! i was going to anyway but you guilt tripped me lmao.

[@UpgrayeDDDDDD]

So would the hardened heap implementation actually mitigate the exploitation via the service_user struct?

[@Dziedzic95]

Great video!

[@OthmanAlikhan]

Thanks for teh video =)

[@TheKyros79]

Great vid!

[@theproapple9904]

Would this work on Windows' WSL?

[@siquod]

I know a sudo exploit and how to fix it. Where can I report it?

[@xodz]

is this a "been around forever" type of exploit? wonder what year it became capable

[@jimothyus]

17:02 anyone know why the qualys initialize an integer with (1+0) ? Line 6

[@Hauketal]

My guess: allocating a variable length buffer is often for strings. Strings lengths need to be adjusted for the \0 byte at the end, not doing that is a traditional security problem. Here this is not needed, so the programmer used an adjustment of +0 as documentation for 'I thought about adjusting, no error here'.

[@chwaee]

For Mac, I don't have "sudoedit" by default, so wouldn't that bypass the whole thought about trying to run this on Mac? I thought we needed sudoedit in order to get in that interesting sudo 'mode' to be exploited? At 18:10 we see the use of "/tmp/sudoedit" meaning the attacker would need to have an already compromised system, and be able to write a file in /tmp/ to attempt privilege escalation. At that point, there are easier ways, like writing a malicious python script in /tmp/ and gaining privileges from that, right? This just doesn't seem to be worth the squeeze on Mac. So feasibility on a Mac: very very improbable I do see a "/usr/sbin/visudo" Mach-O binary on my Mac. Perhaps that would be a better place to start looking for a more realistic approach.