act_pedit vulnerability

modules/bases/debian_bookworm_desktop_kde_unpatched/secgen_metadata.xml

@@ -0,0 +1,30 @@
+<?xml version="1.0"?>
+
+<base xmlns="http://www.github/cliffe/SecGen/base"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://www.github/cliffe/SecGen/base">
+  <name>Debian 12 Bookworm Desktop (unpatched kernel): PROXMOX ONLY</name>
+  <author>Z. Cliffe Schreuders</author>
+  <module_license>GPLv3</module_license>
+  <description>Debian 12 Bookworm Desktop KDE amd64, pinned to the pre-patch template so the kernel remains
+  vulnerable to CVE-2026-46331 (pedit COW). Intended only for training scenarios that require that
+  vulnerability. Proxmox only.</description>
+  <cpu_word_size>64-bit</cpu_word_size>
+  <type>desktop</type>
+
+  <platform>linux</platform>
+  <platform>unix</platform>
+  <distro>Debian 12 Bookworm amd64</distro>
+  <url>https://app.vagrantup.com/secgen/boxes/bookworm-base/versions/1.0.1/providers/virtualbox/amd64/download/vagrant.box</url>
+  <esxi_url>https://app.vagrantup.com/redwiz666/boxes/debian_stretch_desktop_kde/versions/1.0.0/providers/vmware.box</esxi_url>
+  <ovirt_template>buster_desktop_kde_20230615</ovirt_template>
+  <proxmox_template>bookworm-desktop-kde-20241114</proxmox_template>
+
+  <reference>https://atlas.hashicorp.com/puppetlabs</reference>
+  <software_license>various</software_license>
+
+  <!-- another base should not be added to this base -->
+  <conflict>
+    <module_path>bases/.*</module_path>
+  </conflict>
+</base>

modules/utilities/unix/attack_tools/packet_edit/manifests/install.pp

@@ -0,0 +1,19 @@
+class packet_edit::install {
+    Exec { path => ['/bin', '/usr/bin', '/sbin', '/usr/sbin'] }
+
+    ensure_packages(['git', 'make', 'gcc'])
+
+    exec {'clone packet_edit':
+        command => 'git clone https://github.com/sgkdev/packet_edit_meme /opt/packet_edit_meme',
+        creates => '/opt/packet_edit_meme',
+        require => Package['git'],
+    } ->
+    exec {'make packet_edit':
+        command => 'make',
+        cwd     => '/opt/packet_edit_meme',
+        require => [Package['make'], Package['gcc']],
+    } ->
+    exec {'packet_edit world readable':
+        command => 'chmod -R o+rX /opt/packet_edit_meme',
+    }
+}

modules/utilities/unix/attack_tools/packet_edit/packet_edit.pp

@@ -0,0 +1 @@
+include packet_edit::install

modules/utilities/unix/attack_tools/packet_edit/secgen_metadata.xml

@@ -0,0 +1,19 @@
+<?xml version="1.0"?>
+
+<utility xmlns="http://www.github/cliffe/SecGen/utility"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://www.github/cliffe/SecGen/utility">
+  <name>packet_edit</name>
+  <author>Alix Hiscock</author>
+  <module_license>GPLv2</module_license>
+  <description>Installs packet_edit_meme from github repo.</description>
+
+  <type>attack_tools</type>
+  <platform>linux</platform>
+
+  <reference>https://github.com/sgkdev/packet_edit_meme</reference>
+
+  <requires>
+    <type>update</type>
+  </requires>
+</utility>

modules/vulnerabilities/unix/access_control_misconfigurations/pedit/manifests/config.pp

@@ -0,0 +1,46 @@
+class pedit::config {
+  $secgen_parameters = secgen_functions::get_parameters($::base64_inputs_file)
+  $strings_to_leak  = $secgen_parameters['strings_to_leak']
+  $leaked_filenames = $secgen_parameters['leaked_filenames']
+
+  $binpath = ['/bin', '/usr/bin', '/sbin', '/usr/sbin']
+
+  file { '/etc/sysctl.d/99-pedit-userns.conf':
+    ensure  => present,
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0644',
+    content => "kernel.unprivileged_userns_clone = 1\nuser.max_user_namespaces = 15000\n",
+  }
+
+  exec { 'pedit-apply-userns-sysctl':
+    command  => 'sysctl -w kernel.unprivileged_userns_clone=1 ; sysctl -w user.max_user_namespaces=15000',
+    provider => 'shell',
+    path     => $binpath,
+    require  => File['/etc/sysctl.d/99-pedit-userns.conf'],
+  }
+
+  exec { 'pedit-unblacklist-act-pedit':
+    command  => "sed -i '/act_pedit/d' /etc/modprobe.d/*.conf",
+    provider => 'shell',
+    path     => $binpath,
+    onlyif   => 'grep -rlq act_pedit /etc/modprobe.d/',
+  }
+
+  exec { 'pedit-hold-kernel':
+    command  => 'apt-mark hold linux-image-amd64 "linux-image-$(uname -r)"',
+    provider => 'shell',
+    path     => $binpath,
+    unless   => 'apt-mark showhold | grep -q linux-image',
+  }
+
+  ::secgen_functions::leak_files { 'pedit-flag-leak':
+    storage_directory => '/root',
+    leaked_filenames  => $leaked_filenames,
+    strings_to_leak   => $strings_to_leak,
+    owner             => 'root',
+    group             => 'root',
+    mode              => '0600',
+    leaked_from       => 'pedit',
+  }
+}

modules/vulnerabilities/unix/access_control_misconfigurations/pedit/pedit.pp

@@ -0,0 +1 @@
+include pedit::config

modules/vulnerabilities/unix/access_control_misconfigurations/pedit/secgen_metadata.xml

@@ -0,0 +1,54 @@
+<?xml version="1.0"?>
+
+<vulnerability xmlns="http://www.github/cliffe/SecGen/vulnerability"
+          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+          xsi:schemaLocation="http://www.github/cliffe/SecGen/vulnerability">
+  <name>act_pedit Kernel Privilege Escalation (pedit_cow)</name>
+  <author>Alix Hiscock</author>
+  <module_license>MIT</module_license>
+  <description>Prepares a host for local privilege escalation through the kernel net/sched act_pedit
+    action. Unprivileged user namespaces are enabled so a local user can gain CAP_NET_ADMIN in a
+    namespace, the act_pedit module is left loadable (not blacklisted), and the vulnerable kernel is
+    held back from being upgraded. A root-owned flag is leaked so the intended escalation can be
+    demonstrated end to end.</description>
+
+  <type>access_control_misconfiguration</type>
+  <privilege>root_rwx</privilege>
+  <access>local</access>
+  <platform>linux</platform>
+
+  <difficulty>medium</difficulty>
+
+  <requires>
+    <module_path>.*/debian_bookworm_desktop_kde_unpatched</module_path>
+  </requires>
+
+  <read_fact>strings_to_leak</read_fact>
+  <read_fact>leaked_filenames</read_fact>
+
+  <default_input into="strings_to_leak">
+    <generator type="flag_generator"/>
+  </default_input>
+  <default_input into="leaked_filenames">
+    <generator type="filename_generator"/>
+  </default_input>
+
+  <hint>The kernel exposes act_pedit to unprivileged user namespaces and has been pinned to a
+    vulnerable version. Gain CAP_NET_ADMIN in a user namespace and abuse the tc pedit action.</hint>
+  <solution>Escalate to root via the act_pedit kernel flaw reachable through unprivileged user
+    namespaces, then read the flag from /root.</solution>
+
+  <CyBOK KA="AAA" topic="Authorisation">
+    <keyword>access control</keyword>
+    <keyword>Elevated privileges</keyword>
+    <keyword>Vulnerabilities and attacks on access control misconfigurations</keyword>
+  </CyBOK>
+  <CyBOK KA="OSV" topic="Primitives for Isolation and Mediation">
+    <keyword>Access controls and operating systems</keyword>
+    <keyword>Linux security model</keyword>
+  </CyBOK>
+  <CyBOK KA="SS" topic="Categories of Vulnerabilities">
+    <keyword>CVEs and CWEs</keyword>
+  </CyBOK>
+
+</vulnerability>

scenarios/ctf/pedit.xml

@@ -0,0 +1,115 @@
+<?xml version="1.0"?>
+
+<scenario xmlns="http://www.github/cliffe/SecGen/scenario"
+          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+          xsi:schemaLocation="http://www.github/cliffe/SecGen/scenario">
+
+  <name>Pedit</name>
+  <author>Alix Hiscock</author>
+  <description>Hack the web_server from kali.
+  </description>
+
+  <type>ctf</type>
+  <type>attack-ctf</type>
+  <type>pwn-ctf</type>
+  <difficulty>medium</difficulty>
+
+  <CyBOK KA="WAM" topic="Server-Side Vulnerabilities and Mitigations">
+    <keyword>server-side misconfiguration and vulnerable components</keyword>
+    <keyword>Directory traversal</keyword>
+  </CyBOK>
+  <CyBOK KA="MAT" topic="Attacks and exploitation">
+    <keyword>EXPLOITATION</keyword>
+    <keyword>EXPLOITATION FRAMEWORKS</keyword>
+  </CyBOK>
+  <CyBOK KA="SS" topic="Categories of Vulnerabilities">
+    <keyword>CVEs and CWEs</keyword>
+  </CyBOK>
+  <CyBOK KA="SOIM" topic="PENETRATION TESTING">
+    <keyword>PENETRATION TESTING - SOFTWARE TOOLS</keyword>
+    <keyword>PENETRATION TESTING - ACTIVE PENETRATION</keyword>
+  </CyBOK>
+
+  <CyBOK KA="AAA" topic="Authorisation">
+    <keyword>access control</keyword>
+    <keyword>Elevated privileges</keyword>
+    <keyword>Vulnerabilities and attacks on access control misconfigurations</keyword>
+  </CyBOK>
+  <CyBOK KA="OSV" topic="Primitives for Isolation and Mediation">
+    <keyword>Access controls and operating systems</keyword>
+    <keyword>Linux security model</keyword>
+  </CyBOK>
+
+  <system>
+    <system_name>attack_vm</system_name>
+    <base distro="Kali" name="MSF"/>
+
+
+    <input into_datastore="IP_addresses">
+      <!-- 0 attack_vm -->
+      <value>172.16.0.2</value>
+      <!-- 1 hackme_server -->
+      <value>172.16.0.3</value>
+    </input>
+
+    <utility module_path=".*/parameterised_accounts">
+      <input into="accounts">
+        <value>{"username":"kali","password":"kali","super_user":"true","strings_to_leak":[],"leaked_filenames":[]}</value>
+      </input>
+    </utility>
+
+    <utility module_path=".*/iceweasel">
+      <input into="accounts">
+        <value>{"username":"kali","password":"kali","super_user":"true","strings_to_leak":[],"leaked_filenames":[]}</value>
+      </input>
+      <input into="autostart">
+        <value>false</value>
+      </input>
+    </utility>
+
+    <network type="private_network">
+      <input into="IP_address">
+        <datastore access="0">IP_addresses</datastore>
+      </input>
+    </network>
+    <input into_datastore="spoiler_admin_pass">
+      <generator type="strong_password_generator"/>
+    </input>
+    <build type="cleanup">
+      <input into="root_password">
+        <datastore>spoiler_admin_pass</datastore>
+      </input>
+    </build>
+  </system>
+
+  <system>
+    <system_name>web_server</system_name>
+    <base module_path=".*/debian_bookworm_desktop_kde_unpatched"/>
+
+    <vulnerability module_path=".*/nostromo_code_exec">
+      <input into="strings_to_leak">
+        <generator type="flag_generator"/>
+      </input>
+    </vulnerability>
+
+    <utility module_path=".*/packet_edit"></utility>
+
+    <vulnerability module_path=".*/pedit">
+      <input into="strings_to_leak">
+        <generator type="flag_generator"/>
+      </input>
+    </vulnerability>
+
+    <network type="private_network">
+      <input into="IP_address">
+        <datastore access="1">IP_addresses</datastore>
+      </input>
+    </network>
+    <build type="cleanup">
+      <input into="root_password">
+        <datastore>spoiler_admin_pass</datastore>
+      </input>
+    </build>
+  </system>
+
+</scenario>