diff --git a/modules/bases/debian_bookworm_desktop_kde_unpatched/secgen_metadata.xml b/modules/bases/debian_bookworm_desktop_kde_unpatched/secgen_metadata.xml new file mode 100644 index 000000000..bbc18db42 --- /dev/null +++ b/modules/bases/debian_bookworm_desktop_kde_unpatched/secgen_metadata.xml @@ -0,0 +1,31 @@ + + + + Debian 12 Bookworm Desktop (unpatched kernel): PROXMOX ONLY + Z. Cliffe Schreuders + GPLv3 + Debian 12 Bookworm Desktop KDE amd64, pinned to the pre-patch template so the kernel remains + vulnerable to CVE-2026-46331 (pedit COW). Proxmox only. Select this base only with a base module_path + filter of .*/debian_bookworm_desktop_kde_unpatched -- the distro string is intentionally not "Debian 12" + so generic base filters never match it. + 64-bit + desktop + + linux + unix + Bookworm amd64 unpatched-kernel (module_path-only, PROXMOX) + https://app.vagrantup.com/secgen/boxes/bookworm-base/versions/1.0.1/providers/virtualbox/amd64/download/vagrant.box + https://app.vagrantup.com/redwiz666/boxes/debian_stretch_desktop_kde/versions/1.0.0/providers/vmware.box + buster_desktop_kde_20230615 + bookworm-desktop-kde-20241114 + + https://atlas.hashicorp.com/puppetlabs + various + + + + bases/.* + + diff --git a/modules/vulnerabilities/unix/access_control_misconfigurations/pedit/manifests/config.pp b/modules/vulnerabilities/unix/access_control_misconfigurations/pedit/manifests/config.pp new file mode 100644 index 000000000..321ae818d --- /dev/null +++ b/modules/vulnerabilities/unix/access_control_misconfigurations/pedit/manifests/config.pp @@ -0,0 +1,46 @@ +class pedit::config { + $secgen_parameters = secgen_functions::get_parameters($::base64_inputs_file) + $strings_to_leak = $secgen_parameters['strings_to_leak'] + $leaked_filenames = $secgen_parameters['leaked_filenames'] + + $binpath = ['/bin', '/usr/bin', '/sbin', '/usr/sbin'] + + file { '/etc/sysctl.d/99-pedit-userns.conf': + ensure => present, + owner => 'root', + group => 'root', + mode => '0644', + content => "kernel.unprivileged_userns_clone = 1\nuser.max_user_namespaces = 15000\n", + } + + exec { 'pedit-apply-userns-sysctl': + command => 'sysctl -w kernel.unprivileged_userns_clone=1 ; sysctl -w user.max_user_namespaces=15000', + provider => 'shell', + path => $binpath, + require => File['/etc/sysctl.d/99-pedit-userns.conf'], + } + + exec { 'pedit-unblacklist-act-pedit': + command => "sed -i '/act_pedit/d' /etc/modprobe.d/*.conf", + provider => 'shell', + path => $binpath, + onlyif => 'grep -rlq act_pedit /etc/modprobe.d/', + } + + exec { 'pedit-hold-kernel': + command => 'apt-mark hold linux-image-amd64 "linux-image-$(uname -r)"', + provider => 'shell', + path => $binpath, + unless => 'apt-mark showhold | grep -q linux-image', + } + + ::secgen_functions::leak_files { 'pedit-flag-leak': + storage_directory => '/root', + leaked_filenames => $leaked_filenames, + strings_to_leak => $strings_to_leak, + owner => 'root', + group => 'root', + mode => '0600', + leaked_from => 'pedit', + } +} diff --git a/modules/vulnerabilities/unix/access_control_misconfigurations/pedit/pedit.pp b/modules/vulnerabilities/unix/access_control_misconfigurations/pedit/pedit.pp new file mode 100644 index 000000000..ead7038d9 --- /dev/null +++ b/modules/vulnerabilities/unix/access_control_misconfigurations/pedit/pedit.pp @@ -0,0 +1 @@ +include pedit::config diff --git a/modules/vulnerabilities/unix/access_control_misconfigurations/pedit/secgen_metadata.xml b/modules/vulnerabilities/unix/access_control_misconfigurations/pedit/secgen_metadata.xml new file mode 100644 index 000000000..69a1db0c5 --- /dev/null +++ b/modules/vulnerabilities/unix/access_control_misconfigurations/pedit/secgen_metadata.xml @@ -0,0 +1,54 @@ + + + + act_pedit Kernel Privilege Escalation (pedit_cow) + Alix Hiscock + MIT + Prepares a host for local privilege escalation through the kernel net/sched act_pedit + action. Unprivileged user namespaces are enabled so a local user can gain CAP_NET_ADMIN in a + namespace, the act_pedit module is left loadable (not blacklisted), and the vulnerable kernel is + held back from being upgraded. A root-owned flag is leaked so the intended escalation can be + demonstrated end to end. + + access_control_misconfiguration + root_rwx + local + linux + + high + + strings_to_leak + leaked_filenames + + + + + + + + + The kernel exposes act_pedit to unprivileged user namespaces and has been pinned to a + vulnerable version. Gain CAP_NET_ADMIN in a user namespace and abuse the tc pedit action. + Escalate to root via the act_pedit kernel flaw reachable through unprivileged user + namespaces, then read the flag from /root. + + + .*/debian_bookworm_desktop_kde_unpatched + + + + access control + Elevated privileges + Vulnerabilities and attacks on access control misconfigurations + + + Access controls and operating systems + Linux security model + + + CVEs and CWEs + + + diff --git a/scenarios/ctf/pedit.xml b/scenarios/ctf/pedit.xml new file mode 100644 index 000000000..34f96add2 --- /dev/null +++ b/scenarios/ctf/pedit.xml @@ -0,0 +1,113 @@ + + + + + Pedit + Alix Hiscock + Hack the web_server from kali. + + + ctf + attack-ctf + pwn-ctf + medium + + + server-side misconfiguration and vulnerable components + Directory traversal + + + EXPLOITATION + EXPLOITATION FRAMEWORKS + + + CVEs and CWEs + + + PENETRATION TESTING - SOFTWARE TOOLS + PENETRATION TESTING - ACTIVE PENETRATION + + + + access control + Elevated privileges + Vulnerabilities and attacks on access control misconfigurations + + + Access controls and operating systems + Linux security model + + + + attack_vm + + + + + + 172.16.0.2 + + 172.16.0.3 + + + + + {"username":"kali","password":"kali","super_user":"true","strings_to_leak":[],"leaked_filenames":[]} + + + + + + {"username":"kali","password":"kali","super_user":"true","strings_to_leak":[],"leaked_filenames":[]} + + + false + + + + + + IP_addresses + + + + + + + + spoiler_admin_pass + + + + + + web_server + + + + + + + + + + + + + + + + + IP_addresses + + + + + spoiler_admin_pass + + + + +