george-yanni/deeprootCVE-2021-3493 OverlayFS privilege escalation exploit framework with advanced red team features. Includes persistence mechanisms, post-exploitation modules, stealth capabilities, and comprehensive documentation. For authorized testing only.
OverlayFS Capability Privilege Escalation Framework - Red Team Professional Edition
DeepRoot framework is a comprehensive privilege escalation exploit for CVE-2021-3493 (OverlayFS Privilege Escalation) with advanced red team features including persistence mechanisms, stealth capabilities, and post-exploitation modules.
Created by: George S. Yanni
Original Advisory: https://ssd-disclosure.com/ssd-advisory-overlayfs-pe/
FOR EDUCATIONAL AND AUTHORIZED TESTING PURPOSES ONLY
DeepRoot framework is designed for:
DO NOT use against production systems without explicit authorization. Unauthorized access to computer systems is illegal.
CVE-2021-3493 is a privilege escalation vulnerability in the Linux OverlayFS filesystem that allows an unprivileged user to gain root privileges by exploiting improper capability handling in user namespaces.
Key Characteristics:
CLONE_NEWUSER) to map UID 0CLONE_NEWNS) for isolated mountssetxattr()CAP_ALL_EP (all capabilities) on target binaryCVE-2021-3493/
├── comprehensive.c # Main exploit source code
├── README.md # This file
│
├── Option_1_Inject_SSH_backdoor_key/
│ └── README.md # SSH backdoor guide
│
├── Option_2_Install_sudo_backdoor/
│ └── README.md # Sudo backdoor guide
│
├── Option_3_Install_cron_persistence/
│ └── README.md # Cron persistence guide
│
├── Option_4_Install_systemd_service/
│ └── README.md # Systemd service guide
│
├── Option_5_Install_LD_PRELOAD_backdoor/
│ └── README.md # LD_PRELOAD backdoor guide
│
├── Option_6_Collect_system_information/
│ └── README.md # System info collection guide
│
├── Option_7_Search_for_credentials/
│ └── README.md # Credential search guide
│
├── Option_8_Check_lateral_movement/
│ └── README.md # Lateral movement guide
│
├── Option_9_Establish_C2_connection/
│ └── README.md # C2 connection guide
│
├── Option_Shell_and_Cleanup/
│ └── README.md # Shell and cleanup guide
│
└── Stealth_Mode_Guide/
└── README.md # Stealth mode documentation
gcc -o comprehensive comprehensive.c
# Run the exploit
./comprehensive
# The exploit will:
# 1. Create necessary directories (./ovlcap/)
# 2. Set up user and mount namespaces
# 3. Mount OverlayFS
# 4. Set capabilities on binary
# 5. Execute privileged binary
# 6. Present post-exploitation menu
After successful privilege escalation, you'll see:
╔══════════════════════════════════════════════════╗
║ POST-EXPLOITATION MENU ║
╚══════════════════════════════════════════════════╝
Available actions:
1. Inject SSH backdoor key
2. Install sudo backdoor
3. Install cron persistence
4. Install systemd service
5. Install LD_PRELOAD backdoor
6. Collect system information
7. Search for credentials
8. Check lateral movement
9. Establish C2 connection
s. Spawn root shell
0. Cleanup and exit
Select option:
Each option has its own documentation folder with complete guides:
kernel.unprivileged_userns_clone=1 or CAP_SYS_ADMIN)The exploit targets systems vulnerable to CVE-2021-3493. Check your kernel version and ensure user namespaces are available.
Namespace Creation: Creates new user and mount namespaces using unshare(CLONE_NEWNS | CLONE_NEWUSER)
UID/GID Mapping: Maps current unprivileged UID to 0 (root) within the new namespace via /proc/self/uid_map and /proc/self/gid_map
OverlayFS Mount: Mounts OverlayFS with lower, upper, and work directories
Binary Copy: Copies the exploit binary to the overlay merge directory
Capability Injection: Uses setxattr() to set CAP_ALL_EP (all capabilities, effective and permitted) on the copied binary
Privileged Execution: Executes the binary from the upper directory, which has full capabilities and runs as root
The exploit includes optional stealth mode (--stealth flag) that:
nice(19))See Stealth Mode Guide for details.
./comprehensive
# Wait for menu, select 's' for shell
./comprehensive
# Select option 1
# Follow prompts to inject your SSH public key
./comprehensive
# Select option 3
# Cron job installed, runs every 5 minutes
./comprehensive --stealth
# Exploit runs with reduced logging and OPSEC features
IMPORTANT DISCLAIMERS:
Authorization Required: Only use DeepRoot on systems you own or have explicit written permission to test
Legal Liability: Unauthorized access to computer systems is illegal in most jurisdictions. You are solely responsible for your actions
Educational Purpose: DeepRoot is provided for educational and research purposes
No Warranty: This software is provided "as is" without warranty of any kind
Ethical Use: Use responsibly and ethically. Do not harm systems or data
DeepRoot is provided for educational purposes. Use at your own risk.
This is an educational project. Contributions, bug reports, and improvements are welcome, but please ensure all code maintains the educational and ethical standards of this project.
Remember: With great power comes great responsibility. Use DeepRoot ethically and legally.
${\color{3DA300}- \text{George S. Yanni}}$
For any recommendations, improvements, bug reports, or questions about DeepRoot, feel free to reach out on LinkedIn .