// the take
A step-by-step companion repo to LiveOverflow's YouTube series on CVE-2021-3156 (the Sudo Baron Samedit heap overflow), with one Docker-based episode folder per video covering fuzzing, crash triage, and heap exploitation. It's for people studying vulnerability research methodology, not a library or tool anyone would depend on.
Each episode is a self-contained Dockerfile/Makefile snapshot, so you can reproduce the exact state of the research at that point (fuzzing harness, ASan build, heap-grooming script) rather than just getting a final diff. It documents the unglamorous middle of exploit dev - AFL triage, writing a custom GDB extension to walk heap chunks, fengshui scripts to land function pointers - that write-ups usually skip. Pairing each folder with its blog post and video gives the narrated reasoning behind the code, which the code alone doesn't convey.
There's no consolidated working exploit in the repo itself; you're reassembling research artifacts across 14 episodes, and the series stops with episode 14 marked content still coming that never arrived. Documentation outside the videos is thin - a one-paragraph README per episode and a Makefile you're expected to read instead of real docs, so it's hard to follow without watching every video start to finish. It vendors full sudo source trees including compiled .o/.so/.la build artifacts (episode11 ships an entire built sudo-1.8.31p2 tree), which is dead weight if you're trying to clone and experiment. Nothing has been touched since February 2022, so if you're on a modern AFL++ or a newer Docker/glibc, expect to patch the build yourself.
We read the README, the directory tree and a key source file in October 2026. Nobody pays to be listed. How we judge →