Chained Exploit CVE-2025-6018 & CVE-2025-6019 (Auto-Pwn)

This repository contains a full exploit chain ("Auto-Pwn") targeting two critical vulnerabilities primarily affecting openSUSE Leap 15.x / SUSE systems:

1. CVE-2025-6018: PAM Environment Injection. Allows a user to modify sensitive variables (such as XDG_SEAT) via ~/.pam_environment to trick systemd-logind into granting extended privileges (allow_active status).
2. CVE-2025-6019: Privilege Escalation via UDisks2. Exploits improper handling during filesystem resizing (Filesystem.Resize) to temporarily mount a malicious disk image containing a SUID binary.

The tool automates the entire process: SSH connection, malicious image preparation, PAM injection, reconnection to trigger the injection, and finally escalation to root.

Prerequisites

• Python 3
• The paramiko library:
  root@kitploit:~

  pip install -r requirements.txt
  

• An attacker machine (Kali or other Linux) with sudo access to generate the XFS image (automated by the script).
• System tools: dd, mkfs.xfs (xfsprogs package).

Usage

python3 CVE-2025-6018_CVE-2025-6019_autopwn.py -i "$IP" -u "$USER" -p "$PASSWORD"

Automated Script Workflow:

1. Stage 1: Local creation of an XFS image (xfs.image) containing a copy of bash with the SUID bit set.
2. Stage 2: Transfer of files to the target and injection of the ~/.pam_environment file to bypass polkit restrictions.
3. Trigger: Automatic SSH disconnection and reconnection to load the new PAM environment.
4. Stage 3: Execution of the UDisks2 exploit to mount the image and execute the SUID shell, granting a ROOT shell.

Disclaimer

This tool is intended for educational purposes and authorization testing only. Using this exploit on systems without explicit permission is illegal. The author declines any responsibility for misuse.