CVE-2024-48990

CVE-2024-48990 Exploit for CVE-2024-48990 Local Privilege Escalation in needrestart 3.8 Background Read https://blog.qualys.com/vulnerabilities-threat-research/2024/11/19/qualys-tru-uncovers-five-local-privilege-escalation-vulnerabilities-in-needrestart. Qualys does a great job explaining it. TLD...

CVE-2024-48990-PoC

PoC for CVE-2024-48990 in needrestart educational purposes only https://www.qualys.com/2024/11/19/needrestart/needrestart.txt How to run? Running ./start.sh will compile the fake importlib library and start a script that waits for needrestart to be executed by root. It will pop a shell afterwards...

needrestart

needrestart О проекте needrestart проверяет, какие демоны необходимо перезапустить после обновления библиотек. Он вдохновлён checkrestart из пакета debian-goodies. В каталоге ex/ есть несколько скриптов-хуков для использования с apt и dpkg. Эти скрипты вызывают needrestart после установки или...

CVE-2024-48990_needrestart

CVE-2024-48990 - Needrestart 3.7-3 Privilege Escalation Exploit Overview This repository contains an exploit for CVE-2024-48990, a privilege escalation vulnerability in Needrestart 3.7-3. The exploit leverages improper input handling to execute arbitrary code with elevated privileges. Affected...

CVE-2024-48990-Automatic-Exploit

CVE-2024-48990 Secuestro de PYTHONPATH - Exploit de Escalada de Privilegios Esta herramienta automatiza la explotación de una vulnerabilidad de escalada de privilegios en needrestart versión 3.7, identificada como CVE-2024-48990. Logra la ejecución como root aprovechando el uso inseguro de la...

CVE-2024-48990

CVE-2024-48990 POC Overview Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable. This repository contains a...

needrestart-privesc-cve-2024-48990

Повышение привилегий needrestart CVE-2024-48990 Этот репозиторий содержит минимальный эксплойт для локального повышения привилегий, нацеленный на уязвимость в needrestart CVE-2024-48990. Уязвимость позволяет выполнение произвольного кода на Perl с правами root путем злоупотребления опцией...

CVE-2024-11003-POC

CVE-2024-11003-POC Description Qualys discovered that needrestart, before version 3.8, passes unsanitized data to a library Modules::ScanDeps which expects safe input. This could allow a local attacker to execute arbitrary shell commands. Please see the related CVE-2024-10224 in Modules::ScanDeps...

CVE-2024-48990-PoC

This simple shell script should create all the required file for this vulnerability to work. First it creates a randomly generated temporary file that will be used to compile the fake init.so file When the vulnerability is triggered. This file will execute and copy the bash binary to /tmp/ribbit...

CVE-2024-48990

CVE-2024-48990 — needrestart Escalada de Privilegios Local Exploit de escalada de privilegios local que apunta a needrestart /environ, incluido PYTHONPATH. Un usuario local sin privilegios puede explotar esto: 1. Estableciendo PYTHONPATH en un directorio que contenga un paquete malicioso importli...

CVE-2024-48990

PoC for CVE-2024-48990 CVE-2024-48990 is a local privilege escalation vulnerability found in the needrestart utility. The vuln exists in versions prior to 3.8. The service, which runs as root during events like package installations, insecurely scans all running processes. When it finds a Python...

CVE-2024-48990

CVE-2024-48990 hello this is 0x3bs In victim machine: root@kitploit: set -e cd /tmp 1. Create the malicious module directory structure mkdir -p malicious/importlib in attacker machine to compile lib.c in attacker machine : root@kitploit: gcc -shared -fPIC -o exp.so lib.c and in vivtim machine : i...

CVE-2024-48990-POC

CVE-2024-48990-POC Simple poc for CVE-2024-48990 privilege escalation vulnerability with needrestart. https://www.qualys.com/2024/11/19/needrestart/needrestart.txt Overview This was desgined while working through the HackTheBox challenge, 'Conversor'. Slight modifications will be made to generali...

CVE-2024-48990

======================================================================== CVE-2024-48990 and CVE-2024-48992 To determine whether a Python process a process that is running the Python interpreter needs to be restarted, needrestart extracts the PYTHONPATH environment variable from this process's...

CVE-2024-48990

CVE-2024-48990 Exploit Local Privilege Escalation in needrestart 3.8 via PYTHONPATH injection. How It Works 1. needrestart runs as root and scans all processes 2. Finds our Python process, reads PYTHONPATH=/tmp/.m from /proc/pid/environ 3. Executes Python as root with our malicious PYTHONPATH 4...

needrestart-sudo-escalate-cve-2024-4890

CVE-2024-4890: needrestart Sudo Privilege Escalation PoC Disclaimer For lab-only use in controlled environments. Do not exploit on production systems without explicit authorization. This PoC is for educational purposes only. The author is not responsible for any misuse or unauthorized access...

CVE-2024-48990

CVE-2024-48990 !WARNING Estos archivos e información están destinados únicamente con fines educativos. El autor no es responsable de ningún comportamiento malicioso. Toda la información proporcionada no tiene la intención de incitar ningún tipo de crimen o abuso. Descripción Qualys descubrió que...

CVE-2024-48990-PoC

CVE-2024-48990-PoC What is needrestart and how does it work? Needrestart is a widely used utility on Linux systems default on many Ubuntu versions that checks after a software update whether any service or the system itself needs to be restarted. By analyzing running processes, it determines if...

-Linux-PrivEsc-CVE-2024-48990

Privesc-need-restart-2024-48990 Explicación del Exploit CVE-2024-48990 - Pure Python Este script explota la vulnerabilidad CVE-2024-48990 en la utilidad needrestart de Linux mediante el secuestro de la ruta de librerías PYTHONPATH hijacking. A diferencia del vector original, este método utiliza...

CVE-2024-48990

CVE-2024-48990 introdution This vulnerability takes advantage of the way in which needrestart manages the environment variable, to be more precise, PYTHONPATH can be hijacked by modifying the PYTHONPATH variable to a directory that contains a malicious library, thus executing and gaining access, ...