dadhee/cve-2022-0847_dirtypipeexploitA “Dirty Pipe” vulnerability with CVE-2022-0847 and a CVSS score of 7.8 has been identified, affecting Linux Kernel 5.8 and higher. The vulnerability allows attackers to overwrite data in read-only files. Threat actors can exploit this vulnerability to privilege themselves with code injection.
This is Max Kellermann's proof of concept for Dirty Pipe, but modified to overwrite root's password field in /etc/passwd and restore after popping a root shell.
Side Note: I do not claim any credit for finding this vulnerability or writing the proof of concept. This exploit is merely a small modification of Kellermann's proof of concept to enable quick/easy exploitation. Please read the original article on this extremely interesting vulnerability @ https://dirtypipe.cm4all.com/ when you get the opportunity. It really does deserve your time to understand it.
./compile.sh (assumes gcc is installed)./exploit and it'll pop a root shellIf you get this error message:
root with the password aaron./etc/passwd by running mv /tmp/passwd.bak /etc/passwd(oops sorry my laptop battery is dying and my charger broke so I don't have time to fix this the right now, sorry)