deardaniel/secdata-raw huggingface dataset:
Metasploit Module: vmwgfx Driver File Descriptor Handling Priv Esc
Type: exploit
Path: modules/exploits/linux/local/vmwgfx_fd_priv_esc.rb
Disclosure date: 2022-01-28
References: URL-https://grsecurity.net/exploiting_and_defending_against_same_type_object_reuse, URL-https://github.com/opensrcsec/same_type_object_reuse_exploits, CVE-2022-22942

Description:
If the vmwgfx driver fails to copy the 'fence_rep' object to userland, it tries to
          recover by deallocating the (already populated) file descriptor. This is
          wrong, as the fd gets released via put_unused_fd() which shouldn't be used,
          as the fd table slot was already populated via the previous call to
          fd_install(). This leaves userland with a valid fd table entry pointing to
          a free'd 'file' object.

          We use this bug to overwrite a SUID binary with our payload and gain root.
          Linux kernel 4.14-rc1 - 5.17-rc1 are vulnerable.

          Successfully tested against Ubuntu 22.04.01 with kernel 5.13.12-051312-generic.

Check method (fingerprinting):
# Check the kernel version to see if its in a vulnerable range
    release = kernel_release
    begin
      unless Rex::Version.new(release) > Rex::Version.new('4.14-rc1') &&
             Rex::Version.new(release) < Rex::Version.new('5.17-rc1')
        return CheckCode::Safe("Kernel version #{release} is not vulnerable")
      end
    rescue ArgumentError => e
      return CheckCode::Safe("Error determining or processing kernel release (#{release}) into known format: #{e}")
    end

    vprint_good "Kernel version #{release} appears to be vulnerable"

    @driver = nil

    if writable?('/dev/dri/card0') # ubuntu, RHEL
      @driver = '/dev/dri/card0'
    elsif writable?('/dev/dri/renderD128') # debian
      @driver = '/dev/dri/renderD128'
    else
      return CheckCode::Safe('Unable to write to /dev/dri/card0 or /dev/dri/renderD128')
    end
    vprint_good("#{@driver} found writable")

    @suid_target = nil
    if setuid?('/bin/chfn') # ubuntu
      @suid_target = '/bin/chfn'
    elsif writable?('/bin/chage') # RHEL/Centos
      @suid_target = '/bin/chage'
    else
      return CheckCode::Safe('/bin/chfn isn\'t SUID or /bin/chage not writable')
    end
    vprint_good("#{@suid_target} suid binary found")

    if kernel_modules&.include?('vmwgfx')
      return CheckCode::Appears('vmwgfx installed')
    end

    CheckCode::Safe('Vulnerable driver (vmwgfx) not found')
  end
Metasploit Module: Linux PolicyKit Race Condition Privilege Escalation
Type: exploit
Path: modules/exploits/linux/local/pkexec.rb
Disclosure date: 2011-04-01
References: CVE-2011-1485, EDB-17942, OSVDB-72261
Targets: Linux x86, Linux x64

Description:
A race condition flaw was found in the PolicyKit pkexec utility and polkitd
          daemon. A local user could use this flaw to appear as a privileged user to
          pkexec, allowing them to execute arbitrary commands as root by running
          those commands with pkexec.

          Those vulnerable include RHEL6 prior to polkit-0.96-2.el6_0.1 and Ubuntu
          libpolkit-backend-1 prior to 0.96-2ubuntu1.1 (10.10) 0.96-2ubuntu0.1
          (10.04 LTS) and 0.94-1ubuntu1.1 (9.10)

Check method (fingerprinting):
# version can be nil
    version = cmd_exec('pkexec --version').split.last

    # version can be a string, so we check it
    if version.nil? || !Rex::Version.correct?(version)
      vprint_error('pkexec not found or version incorrect')
      return CheckCode::Unknown('pkexec not found or version is incorrect')
    end

    if Rex::Version.new(version) <= Rex::Version.new('0.101')
      vprint_good("pkexec #{version} found")
      return CheckCode::Appears("pkexec version #{version} appears to be vulnerable")
    end

    CheckCode::Detected("pkexec version #{version} is installed but may not be vulnerable")
  end
Metasploit Module: runc (docker) File Descriptor Leak Privilege Escalation
Type: exploit
Path: modules/exploits/linux/local/runc_cwd_priv_esc.rb
Disclosure date: 2024-01-31
References: URL-https://snyk.io/blog/cve-2024-21626-runc-process-cwd-container-breakout/, URL-https://security-tracker.debian.org/tracker/CVE-2024-21626, URL-http://web.archive.org/web/[PII_REDACTED]5740/https://ubuntu.com/security/CVE-2024-21626, CVE-2024-21626

Description:
All versions of runc <=1.1.11, as used by containerization technologies such as Docker engine,
          and Kubernetes are vulnerable to an arbitrary file write.
          Due to a file descriptor leak it is possible to mount the host file system
          with the permissions of runc (typically root).

          Successfully tested on Ubuntu 22.04 with runc 1.1.7-0ubuntu1~22.04.1 and runc 1.1.11 using Docker build.
          Successfully tested on Debian 12.4.0 with runc 1.1.11 using Docker build.
          Successfully tested on Arch Linux 12/1/2024 with runc 1.1.10-1 using Docker build.

Check method (fingerprinting):
sys_info = get_sysinfo

    # Make sure both docker and runc are present
    unless command_exists?('runc')
      return CheckCode::Safe('The runc command was not found on this system')
    end

    unless command_exists?('docker')
      return CheckCode::Safe('The docker command was not found on this system')
    end

    minimum_version = '1.0.0'
    version_info = cmd_exec('runc --version')

    case sys_info[:distro]
    when 'ubuntu'
      version_info =~ /runc version\s+(\d+\S*)/
      unfiltered_version = Regexp.last_match(1)

      # http://web.archive.org/web/[PII_REDACTED]5740/https://ubuntu.com/security/CVE-2024-21626
      if sys_info[:version].include? '23.10' # mantic
        fixed_version = '1.1.7-0ubuntu2.2'
      elsif sys_info[:version].include? '23.04' # lunar
        fixed_version = '1.1.7-0ubuntu1'
      elsif sys_info[:version].include? '22.10' # kinetic
        fixed_version = '1.1.7-0ubuntu1'
      elsif sys_info[:version].include? '22.04' # jammy
        fixed_version = '1.1.7-0ubuntu1~22.04.2'
      elsif sys_info[:version].include? '20.04' # focal
        fixed_version = '1.1.7-0ubuntu1~20.04.2'
      elsif sys_info[:version].include? '18.04' # bionic
        fixed_version = '1.1.4-0ubuntu1~18.04.2+esm1'
      elsif sys_info[:version].include? '16.04'  # xenial
        return CheckCode::Safe('Ubuntu version not affected')
      elsif sys_info[:version].include? '14.04'  # trusty
        return CheckCode::Detected('Patch for this Ubuntu version was ignor
Metasploit Module: Sophos Web Protection Appliance clear_keys.pl Local Privilege Escalation
Type: exploit
Path: modules/exploits/linux/local/sophos_wpa_clear_keys.rb
Disclosure date: 2013-09-06
References: CVE-2013-4984, OSVDB-97028, BID-62265, URL-http://www.coresecurity.com/advisories/sophos-web-protection-appliance-multiple-vulnerabilities
Targets: Linux x86

Description:
This module abuses a command injection on the clear_keys.pl perl script, installed with the
            Sophos Web Protection Appliance, to escalate privileges from the "spiderman" user to "root".
            This module is useful for post exploitation of vulnerabilities on the Sophos Web Protection
            Appliance web ui, executed by the "spiderman" user. This module has been tested successfully
            on Sophos Virtual Web Appliance 3.7.0.

Check method (fingerprinting):
if file?(datastore['clear_keys'])
      return CheckCode::Detected('Vulnerable clear_keys.pl script found')
    end

    return CheckCode::Safe('clear_keys.pl script not found')
  end
Metasploit Module: lastore-daemon D-Bus Privilege Escalation
Type: exploit
Path: modules/exploits/linux/local/lastore_daemon_dbus_priv_esc.rb
Platform: linux
Disclosure date: 2016-02-02
References: CVE-2016-15045, EDB-39433, URL-https://gist.github.com/bcoles/02aa274ce32dc350e34b6d4d1ad0e0e8

Description:
This module attempts to gain root privileges on Deepin Linux systems
          by using lastore-daemon to install a package.

          The lastore-daemon D-Bus configuration on Deepin Linux permits any
          user in the sudo group to install arbitrary system packages without
          providing a password, resulting in code execution as root. By default,
          the first user created on the system is a member of the sudo group.

          This module has been tested successfully with lastore-daemon versions
          0.9.53-1 on Deepin Linux 15.5 (x64); and
          0.9.66-1 on Deepin Linux 15.7 (x64).

Check method (fingerprinting):
%w(lastore-daemon dpkg-deb dbus-send).each do |cmd|
      unless command_exists? cmd
        vprint_error "#{cmd} is not installed. Exploitation will fail."
        return CheckCode::Safe('Required command is not installed')
      end
      vprint_good "#{cmd} is installed"
    end

    unless dbus_priv?
      vprint_error 'User is not permitted to install packages. Exploitation will fail.'
      return CheckCode::Safe('User is not permitted to install packages')
    end
    vprint_good 'User is permitted to install packages'

    CheckCode::Appears('Target appears to be vulnerable')
  end
Metasploit Module: Apache Tomcat on RedHat Based Systems Insecure Temp Config Privilege Escalation
Type: exploit
Path: modules/exploits/linux/local/tomcat_rhel_based_temp_priv_esc.rb
Disclosure date: 2016-10-10
References: EDB-40488, URL-https://access.redhat.com/security/cve/CVE-2016-5425, URL-http://legalhackers.com/advisories/Tomcat-RedHat-Pkgs-Root-PrivEsc-Exploit-CVE-2016-5425.html, URL-https://www.freedesktop.org/software/systemd/man/tmpfiles.d.html, CVE-2016-5425

Description:
This module exploits a vulnerability in RedHat based systems where
          improper file permissions are applied to /usr/lib/tmpfiles.d/tomcat.conf
          for Apache Tomcat versions before 7.0.54-8.  This may also work against

          The configuration files in tmpfiles.d are used by systemd-tmpfiles to manage
          temporary files including their creation.

          With this weak permission, we're able to inject commands into systemd-tmpfiles
          service to write a cron job to execute our payload.

          systemd-tmpfiles is executed by default on boot on RedHat-based systems
          through systemd-tmpfiles-setup.service. Depending on the system in use,
          the execution of systemd-tmpfiles could also be triggered by other
          services, cronjobs, startup scripts etc.

          This module was tested against Tomcat 7.0.54-3 on Fedora 21.

Check method (fingerprinting):
package = cmd_exec('rpm -qa | grep "^tomcat\-[678]"')
    if package.nil? || package.empty?
      return CheckCode::Safe('Unable to execute command to determine installed pacakges')
    end

    package = package.sub('tomcat-', '').strip
    # fedora based cleanup
    package = package.sub(/\.fc\d\d\.noarch/, '')
    # rhel/centos based cleanup
    package = package.sub(/\.el\d_\d\.noarch/, '')
    package = Rex::Version.new(package)

    # The write-up says 6, 7, 8 but doesn't include version numbers. RHEL's writeup says
    # only 7 is effected, so we're going to go off their write-up.
    if package.to_s.start_with?('7') && package < Rex::Version.new('7.0.54-8')
      return CheckCode::Appears("Vulnerable app version detected: #{package}")
    end

    CheckCode::Safe("Unexploitable tomcat packages found: #{package}")
  end
Metasploit Module: ktsuss suid Privilege Escalation
Type: exploit
Path: modules/exploits/linux/local/ktsuss_suid_priv_esc.rb
Platform: linux
Disclosure date: 2011-08-13
References: CVE-2011-2921, URL-https://www.openwall.com/lists/oss-security/2011/08/13/2, URL-https://security.gentoo.org/glsa/201201-15, URL-https://github.com/bcoles/local-exploits/blob/master/CVE-2011-2921/ktsuss-lpe.sh

Description:
This module attempts to gain root privileges by exploiting
          a vulnerability in ktsuss versions 1.4 and prior.

          The ktsuss executable is setuid root and does not drop
          privileges prior to executing user specified commands,
          resulting in command execution with root privileges.

          This module has been tested successfully on:

          ktsuss 1.3 on SparkyLinux 6 (2019.08) (LXQT) (x64); and
          ktsuss 1.3 on SparkyLinux 5.8 (LXQT) (x64).

Check method (fingerprinting):
return CheckCode::Safe("#{ktsuss_path} file not found") unless file? ktsuss_path
    return CheckCode::Safe("#{ktsuss_path} is not setuid") unless setuid? ktsuss_path

    vprint_good "#{ktsuss_path} is setuid"

    id = cmd_exec 'whoami'
    res = cmd_exec("#{ktsuss_path} -u #{id} id").to_s
    vprint_status res

    unless res.include? 'uid=0'
      return CheckCode::Safe('ktsuss does not appear to be exploitable')
    end

    CheckCode::Vulnerable("ktsuss is exploitable")
  end
Metasploit Module: HP System Management Homepage Local Privilege Escalation
Type: exploit
Path: modules/exploits/linux/local/hp_smhstart.rb
Disclosure date: 2013-03-30
References: OSVDB-91990
Targets: HP System Management Homepage 7.1.1, HP System Management Homepage 7.1.2

Description:
Versions of HP System Management Homepage <= 7.1.2 include a setuid root
            smhstart which is vulnerable to a local buffer overflow in SSL_SHARE_BASE_DIR
            env variable.
Metasploit Module: Glibc Tunables Privilege Escalation CVE-2023-4911 (aka Looney Tunables)
Type: exploit
Path: modules/exploits/linux/local/glibc_tunables_priv_esc.rb
Disclosure date: 2023-10-03
References: CVE-2023-4911, URL-https://haxx.in/files/gnu-acme.py, URL-https://www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-so.txt, URL-https://security-tracker.debian.org/tracker/CVE-2023-4911, URL-https://ubuntu.com/security/CVE-2023-4911

Description:
A buffer overflow exists in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES
          environment variable. This issue allows an local attacker to use maliciously crafted GLIBC_TUNABLES when
          launching binaries with SUID permission to execute code in the context of the root user.

          This module targets glibc packaged on Ubuntu and Debian. The specific glibc versions this module targets are:

          Ubuntu:
          2.35-0ubuntu3.4 > 2.35
          2.37-0ubuntu2.1 > 2.37
          2.38-1ubuntu6 > 2.38

          Debian:
          2.31-13-deb11u7 > 2.31
          2.36-9-deb12u3 > 2.36

          Fedora 37 and 38 and other distributions of linux also come packaged with versions of glibc vulnerable to CVE-2023-4911
          however this module does not target them.

Check method (fingerprinting):
glibc_version = cmd_exec('ldd --version')&.scan(/ldd\s+\(\w+\s+GLIBC\s+(\S+)\)/)&.flatten&.first
    return CheckCode::Unknown('Could not get the version of glibc') unless glibc_version

    sysinfo = get_sysinfo
    case sysinfo[:distro]
    when 'ubuntu'
      # Ubuntu's version looks like: 2.35-0ubuntu3.4. The following massaging is necessary for Rex::Version compatibility
      test_version = glibc_version.gsub(/-\d+ubuntu/, '.')
      if Rex::Version.new(test_version).between?(Rex::Version.new('2.35'), Rex::Version.new('2.35.3.4')) ||
         Rex::Version.new(test_version).between?(Rex::Version.new('2.37'), Rex::Version.new('2.37.2.1')) ||
         Rex::Version.new(test_version).between?(Rex::Version.new('2.38'), Rex::Version.new('2.38.6'))
        return CheckCode::Appears("The glibc version (#{glibc_version}) found on the target appears to be vulnerable")
      end
    when 'debian'
      # Debian's version looks like: 2.36-9+deb12u1. The following massaging is necessary for Rex::Version compatibility
      test_version = glibc_version.gsub(/\+deb/, '.').gsub(/u/, '.').gsub('-', '.')
      if Rex::Version.new(test_version).between?(Rex::Version.new('2.31'), Rex::Version.new('2.31.13.11.7')) ||
         Rex::Version.new(test_version).between?(Rex::Version.new('2.36'), Rex::Version.new('2.36.9.12.3'))
        return CheckCode::Appears("The glibc version (#{glibc_version}) found on the target appears to be vulnerable")
      end
    else
      return CheckCode::Unknown('
Metasploit Module: AddressSanitizer (ASan) SUID Executable Privilege Escalation
Type: exploit
Path: modules/exploits/linux/local/asan_suid_executable_priv_esc.rb
Platform: linux
Disclosure date: 2016-02-17
References: URL-https://seclists.org/oss-sec/2016/q1/363, URL-https://seclists.org/oss-sec/2016/q1/379, URL-https://gist.github.com/0x27/9ff2c8fb445b6ab9c94e, URL-https://github.com/bcoles/local-exploits/tree/master/asan-suid-root

Description:
This module attempts to gain root privileges on Linux systems using
          setuid executables compiled with AddressSanitizer (ASan).

          ASan configuration related environment variables are permitted when
          executing setuid executables built with libasan. The `log_path` option
          can be set using the `ASAN_OPTIONS` environment variable, allowing
          clobbering of arbitrary files, with the privileges of the setuid user.

          This module uploads a shared object and sprays symlinks to overwrite
          `/etc/ld.so.preload` in order to create a setuid root shell.

Check method (fingerprinting):
return CheckCode::Safe("#{suid_exe_path} file not found") unless file? suid_exe_path
    return CheckCode::Safe("#{suid_exe_path} is not setuid") unless setuid? suid_exe_path

    vprint_good "#{suid_exe_path} is setuid"

    # Check if the executable was compiled with ASan
    #
    # If the setuid executable is readable, and `ldd` is installed and in $PATH,
    # we can detect ASan via linked libraries. (`objdump` could also be used).
    #
    # Otherwise, we can try to detect ASan via the help output with the `help=1` option.
    # This approach works regardless of whether the setuid executable is readable,
    # with the obvious disadvantage that it requires invoking the executable.

    if readable? suid_exe_path && command_exists?('ldd')
      unless cmd_exec("ldd #{suid_exe_path}").to_s.include? 'libasan.so'
        vprint_error "#{suid_exe_path} was not compiled with ASan"
        return CheckCode::Safe('SUID executable was not compiled with ASan')
      end
    else
      unless cmd_exec("ASAN_OPTIONS=help=1 #{suid_exe_path}").include? 'AddressSanitizer'
        vprint_error "#{suid_exe_path} was not compiled with ASan"
        return CheckCode::Safe('SUID executable was not compiled with ASan')
      end
    end
    vprint_good "#{suid_exe_path} was compiled with ASan"

    unless has_gcc?
      print_error 'gcc is not installed. Compiling will fail.'
      return CheckCode::Safe('gcc is not installed')
    end
    vprint_good 'gcc is installed'

    CheckCode::App
Metasploit Module: SystemTap MODPROBE_OPTIONS Privilege Escalation
Type: exploit
Path: modules/exploits/linux/local/systemtap_modprobe_options_priv_esc.rb
Platform: linux
Disclosure date: 2010-11-17
References: BID-44914, CVE-2010-4170, EDB-15620, URL-https://securitytracker.com/id?1024754, URL-https://access.redhat.com/security/cve/cve-2010-4170, URL-https://bugzilla.redhat.com/show_bug.cgi?id=653604, URL-http://web.archive.org/web/[PII_REDACTED]5111/https://lists.fedoraproject.org/pipermail/package-announce/2010-November/051115.html, URL-https://bugs.launchpad.net/bugs/677226, URL-https://www.debian.org/security/2011/dsa-2348

Description:
This module attempts to gain root privileges by exploiting a
          vulnerability in the `staprun` executable included with SystemTap
          version 1.3.

          The `staprun` executable does not clear environment variables prior to
          executing `modprobe`, allowing an arbitrary configuration file to be
          specified in the `MODPROBE_OPTIONS` environment variable, resulting
          in arbitrary command execution with root privileges.

          This module has been tested successfully on:

          systemtap 1.2-1.fc13-i686 on Fedora 13 (i686); and
          systemtap 1.1-3.el5 on RHEL 5.5 (x64).

Check method (fingerprinting):
return CheckCode::Safe("#{staprun_path} file not found") unless file? staprun_path

    # On some systems, staprun execution is restricted to stapusr group:
    # ---s--x---. 1 root stapusr 178488 Mar 28  2014 /usr/bin/staprun
    return CheckCode::Safe("#{staprun_path} is not executable") unless executable?(staprun_path)

    vprint_good "#{staprun_path} is executable"

    return CheckCode::Safe("#{staprun_path} is not setuid") unless setuid? staprun_path

    vprint_good "#{staprun_path} is setuid"

    CheckCode::Detected('staprun is installed and setuid')
  end
Metasploit Module: Linux Polkit pkexec helper PTRACE_TRACEME local root exploit
Type: exploit
Path: modules/exploits/linux/local/ptrace_traceme_pkexec_helper.rb
Disclosure date: 2019-07-04
References: CVE-2019-13272, EDB-47133, URL-https://github.com/bcoles/kernel-exploits/tree/master/CVE-2019-13272, URL-https://bugs.chromium.org/p/project-zero/issues/detail?id=1903

Description:
This module exploits an issue in ptrace_link in kernel/ptrace.c before Linux
          kernel 5.1.17. This issue can be exploited from a Linux desktop terminal, but
          not over an SSH session, as it requires execution from within the context of
          a user with an active Polkit agent.
          In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles
          the recording of the credentials of a process that wants to create a ptrace
          relationship, which allows local users to obtain root access by leveraging
          certain scenarios with a parent-child process relationship, where a parent drops
          privileges and calls execve (potentially allowing control by an attacker). One
          contributing factor is an object lifetime issue (which can also cause a panic).
          Another contributing factor is incorrect marking of a ptrace relationship as
          privileged, which is exploitable through (for example) Polkit's pkexec helper
          with PTRACE_TRACEME.

Check method (fingerprinting):
# Introduced in 4.10, but also backported
    # Patched in 4.4.185, 4.9.185, 4.14.133, 4.19.58, 5.1.17
    release = kernel_release
    v = Rex::Version.new release.split('-').first

    if v >= Rex::Version.new('5.1.17') || v < Rex::Version.new('3')
      vprint_error "Kernel version #{release} is not vulnerable"
      return CheckCode::Safe("Kernel version #{release} is not vulnerable")
    end
    vprint_good "Kernel version #{release} appears to be vulnerable"

    unless command_exists? 'pkexec'
      vprint_error 'pkexec is not installed'
      return CheckCode::Safe('pkexec is not installed')
    end
    vprint_good 'pkexec is installed'

    arch = kernel_hardware
    unless arch.include? 'x86_64'
      vprint_error "System architecture #{arch} is not supported"
      return CheckCode::Safe("System architecture #{arch} is not supported")
    end
    vprint_good "System architecture #{arch} is supported"

    loginctl_output = cmd_exec('loginctl --no-ask-password show-session "$XDG_SESSION_ID" | grep Remote')
    if loginctl_output =~ /Remote=yes/
      print_warning 'This exploit requires a valid policykit session (it cannot be executed over ssh)'
      return CheckCode::Safe('Exploit requires a valid policykit session')
    end

    CheckCode::Appears("Kernel version #{release} appears to be vulnerable")
  end