Pack2TheRoot Lab — CVE-2026-41651

A Dockerised, CTF-style local-privilege-escalation lab built around the Pack2TheRoot advisory (CVE-2026-41651), a 12-year-old flaw in the PackageKit daemon disclosed by Deutsche Telekom's Red Team on 22 April 2026.

The lab includes three containers: a permissive-polkit CTF challenge, a hardened comparison target, and a full TOCTOU exploit reproduction that builds the vulnerable PackageKit from source and runs the actual CVE-2026-41651 root-cause exploit.

1. What you get

Plus:

• A player-facing challenge brief (docs/CHALLENGE.md)
• Progressive hints (docs/HINTS.md)
• Full walkthrough & flag (docs/SOLUTION.md)
• Visual diagrams of the exploit flow (docs/diagrams/)
• Defender tooling: version check, IOC monitor, side-by-side compare, interim polkit mitigation script.

2. Vulnerability summary

Root cause — three chained bugs in pk-transaction.c

The exploit sends two async D-Bus InstallFiles() calls on the same transaction: first with SIMULATE (bypasses polkit, queues a GLib idle callback), then immediately with NONE + the malicious package (overwrites the cached flags/paths before the idle fires). GLib's priority ordering guarantees both D-Bus messages dispatch before the idle callback — making this deterministic, not a timing race.

Known IOC (from the advisory):

journalctl --no-pager -u packagekit | grep -iE 'emitted_finished|pk_transaction_finished_emit|pk-transaction\.c:514'

3. Quick start

git clone https://github.com/dinosn/pack2theroot-lab.git
cd pack2theroot-lab
docker compose build
docker compose up -d

CTF challenge (permissive polkit path)

ssh labuser@localhost -p 2222     # password: labuser
# then work through docs/CHALLENGE.md

The flag is at /root/flag.txt (mode 0400 root:root). Format: PACK2THEROOT{...}

TOCTOU exploit reproduction (actual CVE root cause)

# Build and run — auto-mode executes the exploit immediately:
docker compose run --rm exploit

# Or manual mode:
docker compose run --rm --entrypoint /entrypoint.sh exploit
# Then inside the container:
su - victim -c /exploit/cve-2026-41651

The exploit builds two .deb packages in C (no external tools needed), sends the two-call D-Bus race, and creates a SUID bash at /tmp/.suid_bash. See docs/SOLUTION.md for the full technical walkthrough.

Tear down:

docker compose down -v

4. Repository layout

pack2theroot-lab/
├── README.md
├── docker-compose.yml
├── docs/
│   ├── CHALLENGE.md         # player brief
│   ├── HINTS.md             # progressive hints (both paths)
│   ├── SOLUTION.md          # full walkthrough + flag
│   ├── references.md        # primary and secondary sources
│   ├── threat-model.md      # attacker/defender assumptions
│   └── diagrams/            # SVG visual diagrams of the exploit flow
│       ├── 01-docker-build.svg
│       ├── 02-container-startup.svg
│       ├── 03-exploit-execution.svg
│       ├── 04-dbus-race-sequence.svg
│       ├── 05-attack-overview.svg
│       └── 06-auto-mode-full-run.svg
├── exploit/
│   ├── Dockerfile           # builds vulnerable PackageKit 1.3.4 from source
│   ├── entrypoint.sh        # starts dbus + polkitd + packagekitd
│   ├── Makefile
│   └── src/
│       └── cve-2026-41651.c # the TOCTOU exploit (public PoC)
├── vulnerable/
│   ├── Dockerfile
│   ├── entrypoint.sh
│   └── policy/
│       └── 10-pack2theroot-lab-misconfig.rules   # CTF challenge
├── patched/
│   ├── Dockerfile
│   ├── entrypoint.sh
│   ├── local/                # drop a 1.3.5 backport RPM here (optional)
│   └── policy/
│       └── 10-pack2theroot-lab-hardened.rules    # the fix
└── scripts/
    ├── exploit-check.sh         # checks version, polkit, D-Bus, IOCs
    ├── check-version.sh         # VULNERABLE vs PATCHED verdict
    ├── check-preconditions.sh   # pkcon / polkit / D-Bus sanity
    ├── monitor-ioc.sh           # tail journal for the advisory IOC
    ├── compare-env.sh           # diff both containers
    └── apply-polkit-mitigation.sh  # interim hardening for unpatched hosts

5. Visual diagrams

The docs/diagrams/ directory contains SVG diagrams showing the exploit flow. Open them in any browser:

6. Playing the CTF challenge

See docs/CHALLENGE.md. TL;DR:

1. SSH in as labuser (password labuser).
2. Recon the polkit rules. One of them is way too permissive.
3. Build a malicious RPM (rpm-build, rpmdevtools are installed).
4. Install it with pkcon install-local --allow-untrusted.
5. The %post scriptlet runs as root. Read /root/flag.txt.

Stuck? docs/HINTS.md has progressively more explicit hints. Only open docs/SOLUTION.md after you've either solved it or genuinely need the write-up.

7. Running the defender tooling

Inside either container, as any user:

/opt/lab/check-version.sh         # VULNERABLE or PATCHED verdict
/opt/lab/check-preconditions.sh   # exposure self-check
/opt/lab/exploit-check.sh         # version + polkit + D-Bus + IOC check
/opt/lab/monitor-ioc.sh           # tail the journal for the IOC

From the host, side-by-side:

./scripts/compare-env.sh

Apply the interim polkit mitigation to a vulnerable container:

docker exec pack2theroot-vuln /opt/lab/apply-polkit-mitigation.sh
# Then retry the exploit — should now fail.

8. Patched image — backport status

The patched image handles PackageKit version status honestly:

• It installs whatever PackageKit the distro currently ships.
• It surfaces a clear banner (/etc/pack2theroot-banner) stating whether the installed version is the real patch or a distro placeholder.
• Regardless of version, it ships a hardened polkit rule that blocks the authenticationless install path.

To build a version-complete patched image once your distro publishes the backport, drop the RPM(s) into patched/local/ and rebuild:

docker compose build --build-arg USE_LOCAL_RPM=1 patched

9. Safety and responsible use

• Do not ship either container image on a shared Docker host with untrusted users.
• The exploit container requires --privileged to run the full dbus/polkitd/packagekitd stack. Only run it in isolated environments.
• The SSH password (labuser) is intentionally weak. Never reuse it.
• For authorised defensive research, education, and penetration testing only.

10. References

Primary sources:

• Telekom Security advisory — https://github.security.telekom.com/2026/04/pack2theroot-linux-local-privilege-escalation.html
• NVD — CVE-2026-41651: https://nvd.nist.gov/vuln/detail/CVE-2026-41651
• Upstream fix — PackageKit 1.3.5: https://github.com/PackageKit/PackageKit/releases/tag/v1.3.5
• Fix commit — 76cfb675: https://github.com/PackageKit/PackageKit/commit/76cfb675fb31acc3ad5595d4380bfff56d2a8697
• Public PoC — Vozec: https://github.com/Vozec/CVE-2026-41651

See docs/references.md for secondary coverage and distribution trackers.

11. License

MIT — see LICENSE.