From 27c735b8ede742b25b6f6ae2f58790daeb6cde78 Mon Sep 17 00:00:00 2001 From: alixthegreat Date: Wed, 29 Jul 2026 17:19:14 +0100 Subject: [PATCH 1/4] Add unpatched Debian 12 Bookworm KDE base --- .../secgen_metadata.xml | 30 +++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 modules/bases/debian_bookworm_desktop_kde_unpatched/secgen_metadata.xml diff --git a/modules/bases/debian_bookworm_desktop_kde_unpatched/secgen_metadata.xml b/modules/bases/debian_bookworm_desktop_kde_unpatched/secgen_metadata.xml new file mode 100644 index 000000000..5dcc4b56e --- /dev/null +++ b/modules/bases/debian_bookworm_desktop_kde_unpatched/secgen_metadata.xml @@ -0,0 +1,30 @@ + + + + Debian 12 Bookworm Desktop (unpatched kernel): PROXMOX ONLY + Z. Cliffe Schreuders + GPLv3 + Debian 12 Bookworm Desktop KDE amd64, pinned to the pre-patch template so the kernel remains + vulnerable to CVE-2026-46331 (pedit COW). Intended only for training scenarios that require that + vulnerability. Proxmox only. + 64-bit + desktop + + linux + unix + Debian 12 Bookworm amd64 + https://app.vagrantup.com/secgen/boxes/bookworm-base/versions/1.0.1/providers/virtualbox/amd64/download/vagrant.box + https://app.vagrantup.com/redwiz666/boxes/debian_stretch_desktop_kde/versions/1.0.0/providers/vmware.box + buster_desktop_kde_20230615 + bookworm-desktop-kde-20241114 + + https://atlas.hashicorp.com/puppetlabs + various + + + + bases/.* + + From b25d8f2edfe024ce78b21404d530425bd58836a3 Mon Sep 17 00:00:00 2001 From: alixthegreat Date: Wed, 29 Jul 2026 17:53:25 +0100 Subject: [PATCH 2/4] Add act_pedit kernel privilege escalation vulnerability module --- .../pedit/manifests/config.pp | 46 ++++++++++++++++ .../pedit/pedit.pp | 1 + .../pedit/secgen_metadata.xml | 54 +++++++++++++++++++ 3 files changed, 101 insertions(+) create mode 100644 modules/vulnerabilities/unix/access_control_misconfigurations/pedit/manifests/config.pp create mode 100644 modules/vulnerabilities/unix/access_control_misconfigurations/pedit/pedit.pp create mode 100644 modules/vulnerabilities/unix/access_control_misconfigurations/pedit/secgen_metadata.xml diff --git a/modules/vulnerabilities/unix/access_control_misconfigurations/pedit/manifests/config.pp b/modules/vulnerabilities/unix/access_control_misconfigurations/pedit/manifests/config.pp new file mode 100644 index 000000000..321ae818d --- /dev/null +++ b/modules/vulnerabilities/unix/access_control_misconfigurations/pedit/manifests/config.pp @@ -0,0 +1,46 @@ +class pedit::config { + $secgen_parameters = secgen_functions::get_parameters($::base64_inputs_file) + $strings_to_leak = $secgen_parameters['strings_to_leak'] + $leaked_filenames = $secgen_parameters['leaked_filenames'] + + $binpath = ['/bin', '/usr/bin', '/sbin', '/usr/sbin'] + + file { '/etc/sysctl.d/99-pedit-userns.conf': + ensure => present, + owner => 'root', + group => 'root', + mode => '0644', + content => "kernel.unprivileged_userns_clone = 1\nuser.max_user_namespaces = 15000\n", + } + + exec { 'pedit-apply-userns-sysctl': + command => 'sysctl -w kernel.unprivileged_userns_clone=1 ; sysctl -w user.max_user_namespaces=15000', + provider => 'shell', + path => $binpath, + require => File['/etc/sysctl.d/99-pedit-userns.conf'], + } + + exec { 'pedit-unblacklist-act-pedit': + command => "sed -i '/act_pedit/d' /etc/modprobe.d/*.conf", + provider => 'shell', + path => $binpath, + onlyif => 'grep -rlq act_pedit /etc/modprobe.d/', + } + + exec { 'pedit-hold-kernel': + command => 'apt-mark hold linux-image-amd64 "linux-image-$(uname -r)"', + provider => 'shell', + path => $binpath, + unless => 'apt-mark showhold | grep -q linux-image', + } + + ::secgen_functions::leak_files { 'pedit-flag-leak': + storage_directory => '/root', + leaked_filenames => $leaked_filenames, + strings_to_leak => $strings_to_leak, + owner => 'root', + group => 'root', + mode => '0600', + leaked_from => 'pedit', + } +} diff --git a/modules/vulnerabilities/unix/access_control_misconfigurations/pedit/pedit.pp b/modules/vulnerabilities/unix/access_control_misconfigurations/pedit/pedit.pp new file mode 100644 index 000000000..ead7038d9 --- /dev/null +++ b/modules/vulnerabilities/unix/access_control_misconfigurations/pedit/pedit.pp @@ -0,0 +1 @@ +include pedit::config diff --git a/modules/vulnerabilities/unix/access_control_misconfigurations/pedit/secgen_metadata.xml b/modules/vulnerabilities/unix/access_control_misconfigurations/pedit/secgen_metadata.xml new file mode 100644 index 000000000..06a7b3b47 --- /dev/null +++ b/modules/vulnerabilities/unix/access_control_misconfigurations/pedit/secgen_metadata.xml @@ -0,0 +1,54 @@ + + + + act_pedit Kernel Privilege Escalation (pedit_cow) + Alix Hiscock + MIT + Prepares a host for local privilege escalation through the kernel net/sched act_pedit + action. Unprivileged user namespaces are enabled so a local user can gain CAP_NET_ADMIN in a + namespace, the act_pedit module is left loadable (not blacklisted), and the vulnerable kernel is + held back from being upgraded. A root-owned flag is leaked so the intended escalation can be + demonstrated end to end. + + access_control_misconfiguration + root_rwx + local + linux + + medium + + + .*/debian_bookworm_desktop_kde_unpatched + + + strings_to_leak + leaked_filenames + + + + + + + + + The kernel exposes act_pedit to unprivileged user namespaces and has been pinned to a + vulnerable version. Gain CAP_NET_ADMIN in a user namespace and abuse the tc pedit action. + Escalate to root via the act_pedit kernel flaw reachable through unprivileged user + namespaces, then read the flag from /root. + + + access control + Elevated privileges + Vulnerabilities and attacks on access control misconfigurations + + + Access controls and operating systems + Linux security model + + + CVEs and CWEs + + + From da83d01f15dc9617c1dbffc5829a7d28221e71ee Mon Sep 17 00:00:00 2001 From: alixthegreat Date: Wed, 29 Jul 2026 17:53:54 +0100 Subject: [PATCH 3/4] Add packet_edit attack tool for act_pedit exploitation --- .../packet_edit/manifests/install.pp | 19 +++++++++++++++++++ .../attack_tools/packet_edit/packet_edit.pp | 1 + .../packet_edit/secgen_metadata.xml | 19 +++++++++++++++++++ 3 files changed, 39 insertions(+) create mode 100644 modules/utilities/unix/attack_tools/packet_edit/manifests/install.pp create mode 100644 modules/utilities/unix/attack_tools/packet_edit/packet_edit.pp create mode 100644 modules/utilities/unix/attack_tools/packet_edit/secgen_metadata.xml diff --git a/modules/utilities/unix/attack_tools/packet_edit/manifests/install.pp b/modules/utilities/unix/attack_tools/packet_edit/manifests/install.pp new file mode 100644 index 000000000..d08844692 --- /dev/null +++ b/modules/utilities/unix/attack_tools/packet_edit/manifests/install.pp @@ -0,0 +1,19 @@ +class packet_edit::install { + Exec { path => ['/bin', '/usr/bin', '/sbin', '/usr/sbin'] } + + ensure_packages(['git', 'make', 'gcc']) + + exec {'clone packet_edit': + command => 'git clone https://github.com/sgkdev/packet_edit_meme /opt/packet_edit_meme', + creates => '/opt/packet_edit_meme', + require => Package['git'], + } -> + exec {'make packet_edit': + command => 'make', + cwd => '/opt/packet_edit_meme', + require => [Package['make'], Package['gcc']], + } -> + exec {'packet_edit world readable': + command => 'chmod -R o+rX /opt/packet_edit_meme', + } +} \ No newline at end of file diff --git a/modules/utilities/unix/attack_tools/packet_edit/packet_edit.pp b/modules/utilities/unix/attack_tools/packet_edit/packet_edit.pp new file mode 100644 index 000000000..d5b799492 --- /dev/null +++ b/modules/utilities/unix/attack_tools/packet_edit/packet_edit.pp @@ -0,0 +1 @@ +include packet_edit::install \ No newline at end of file diff --git a/modules/utilities/unix/attack_tools/packet_edit/secgen_metadata.xml b/modules/utilities/unix/attack_tools/packet_edit/secgen_metadata.xml new file mode 100644 index 000000000..f62b51e8b --- /dev/null +++ b/modules/utilities/unix/attack_tools/packet_edit/secgen_metadata.xml @@ -0,0 +1,19 @@ + + + + packet_edit + Alix Hiscock + GPLv2 + Installs packet_edit_meme from github repo. + + attack_tools + linux + + https://github.com/sgkdev/packet_edit_meme + + + update + + \ No newline at end of file From b7e68e160636944bb17c16484e51cb5a3172c557 Mon Sep 17 00:00:00 2001 From: alixthegreat Date: Wed, 29 Jul 2026 17:54:26 +0100 Subject: [PATCH 4/4] Add Pedit CTF scenario --- scenarios/ctf/pedit.xml | 115 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 115 insertions(+) create mode 100644 scenarios/ctf/pedit.xml diff --git a/scenarios/ctf/pedit.xml b/scenarios/ctf/pedit.xml new file mode 100644 index 000000000..a24d351a0 --- /dev/null +++ b/scenarios/ctf/pedit.xml @@ -0,0 +1,115 @@ + + + + + Pedit + Alix Hiscock + Hack the web_server from kali. + + + ctf + attack-ctf + pwn-ctf + medium + + + server-side misconfiguration and vulnerable components + Directory traversal + + + EXPLOITATION + EXPLOITATION FRAMEWORKS + + + CVEs and CWEs + + + PENETRATION TESTING - SOFTWARE TOOLS + PENETRATION TESTING - ACTIVE PENETRATION + + + + access control + Elevated privileges + Vulnerabilities and attacks on access control misconfigurations + + + Access controls and operating systems + Linux security model + + + + attack_vm + + + + + + 172.16.0.2 + + 172.16.0.3 + + + + + {"username":"kali","password":"kali","super_user":"true","strings_to_leak":[],"leaked_filenames":[]} + + + + + + {"username":"kali","password":"kali","super_user":"true","strings_to_leak":[],"leaked_filenames":[]} + + + false + + + + + + IP_addresses + + + + + + + + spoiler_admin_pass + + + + + + web_server + + + + + + + + + + + + + + + + + + + IP_addresses + + + + + spoiler_admin_pass + + + + +